@tanstack/query-core rebuilds byte-for-byte from your commit (365/365 files)

[ujjwalv01]

Hi TanStack team,

I'm Ujjwal, maintainer of releaseproof (https://github.com/ujjwalv01/releaseproof), an open-source tool that rebuilds an npm release from the commit its provenance certifies and compares it file by file with what's on the registry.

I ran it on @tanstack/query-core@5.104.3: all 365 files are identical to a clean build of ee47993, and the provenance from your release workflow verifies. That's one of the largest packages I've checked, and it's a great example of a reproducible monorepo release.

Since you publish many packages from one workflow, you could run the same check automatically after each release (one step: ujjwalv01/releaseproof@v0.2.2), or before approval if you move to npm staged publishing. It needs no permissions and fails the job only if a release doesn't match its source.

Results for other packages: https://github.com/ujjwalv01/releaseproof/blob/main/docs/real-world-results.md

No action needed. I just thought you'd like to know your releases verify cleanly. Feedback very welcome.

Ujjwal Verma
https://github.com/ujjwalv01