Verifies the built release ZIP after upload by:
- Downloading the artifact from the release URL
- Extracting and checking manifest version matches release version
- Comparing SHA256 against updates.xml
- Scanning for disallowed files (.claude, .env, TODO.md, node_modules)
- Checking for non-vendor .min files that should be runtime-generated
Fails the pipeline if any critical check fails.
Authored-by: Moko Consulting
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>