ci: replace the asset auto-commit with a staleness gate, drop dist orphans

[awcodes]

The Build Assets workflow started failing on the last two merges. Looking into it, it could never have worked — so this removes it and replaces the concern behind it with a check. It also clears out two dead files in resources/dist that the investigation turned up.

Why it failed

It checks out github.head_ref, the PR's source branch. Both merges deleted the branch, so the ref was gone by the time the workflow ran and git fetch failed:

git fetch --depth=1 origin +refs/heads/fix/glider-string-media-key*:...
The process '/usr/bin/git' failed with exit code 1

Why fixing the checkout wouldn't have helped

It commits to the wrong branch. git-auto-commit-action pushes to whatever is checked out — the just-merged feature branch, not 5.x. Even on a green run the rebuilt asset never reaches the release branch.

Its path filter doesn't match the build. bin/build.js esbuilds exactly two entry points, resources/js/curation.js and resources/js/rich-editor-integration.js. It never reads blade views and emits no CSS, so the resources/views/**.php and resources/css/**.css triggers can't change any build output.

The history agrees: four runs total (two failures this week, one skipped in July, one that died on npm ci back in March), and not one produced a commit. Every commit touching resources/dist has been by hand.

What replaces it

The concern is real — resources/dist is committed and shipped, so a change to resources/js that lands without a rebuild silently publishes stale assets. That's better caught on the PR than after a tag is cut, so the new Assets job in ci.yml rebuilds and fails if resources/dist differs from what's committed:

- name: Check that dist is current
  run: |
    if [ -n "$(git status --porcelain -- resources/dist)" ]; then
      echo "::error::resources/dist is out of date. Run 'npm run build' and commit the result."
      ...
      exit 1
    fi

git status --porcelain rather than git diff --exit-code so a new dist file (untracked) counts as stale too, not just a modified one. Verified locally against a clean tree, a hand-edited dist file, and an untracked new one.

This is a local job, not part of the shared baseline — the shared workflow's run-build input is a different thing (it builds assets for suites that need them and checks nothing), and Curator correctly leaves it false.

Actions are pinned to full commit SHAs per the repo convention, reusing the pins the deleted workflow already carried.

Dropping the dist orphans

resources/dist/curator.css and resources/dist/curator.js are unreachable on this line. Neither is produced by bin/build.js — a rebuild after removing them leaves dist with only the two entry points the build actually emits — and a sweep of the repo (excluding vendor/, node_modules/, dist/ itself) finds zero references from src/, the views, the config, or the docs.

• curator.js hasn't been registered since before v3 shipped, last modified 2023-09-03. It still fetches /curator/media and drives a showUploadForm flag no current view has.
• curator.css was registered on 3.x as Css::make('curator', ...)->loadedOnRequest(), but the v4 rewrite in d104cf4 dropped that registration. No README or UPGRADE revision has ever pointed at this path — v4 and v5 tell users to import resources/css/plugin.css, and on v3 the service provider loaded it, so nothing was importing it by hand either.

3.x is untouched and keeps its own copy, which is still live there.

Notes

• The tagged release is fine. npm ci && npm run build on 5.x produces a resources/dist byte-identical to what's committed. Nothing stale shipped.
• CLAUDE.md's CI section still named a ci-filament-5.yml that Support Filament 4 and 5 from a single branch #720 folded into ci.yml; corrected here along with the new check.
• composer test is green: 218 passed, PHPStan clean, no Pint or Rector drift.

🤖 Generated with Claude Code