fix(registry): check the ref a package is built from, not HEAD

[moshest]

Follow-up to #105, which added ref to unversioned git sources and pinned lucia to its v3 branch.

The bug

getHeadCommit(url) always ran git ls-remote <url> HEAD — the default branch. Both skip-if-unchanged checks in publish-all called it without the ref, so a package built from a branch had its stored source_commit compared against a completely unrelated commit.

For lucia, measured against the real remote:

HEAD (main): c3c9f7ed
ref v3:      fc016ca8

Those can never be equal, so the skip never fires: lucia would be cloned, rebuilt and republished on every nightly run, forever, for a package whose docs have not changed since 2024. Not a failure — just permanent wasted work and an unnecessary republish of identical content each night.

The fix

getHeadCommit(url, ref?) resolves the ref it is given, and both call sites pass def.source.ref. Behaviour for definitions without a ref is unchanged.

Verified against the real remote: the two calls now return different commits, and the one used for the check matches what buildUnversioned records.

pnpm lint    ✓
pnpm build   ✓
pnpm test    ✓  219 + 39 passed

No changeset — @neuledge/registry is private: true.

How this was found

#105 merged without the adversarial review pass I'd planned, because the review agent died on a session limit and the nightly registry job had already failed five nights running. I judged the trade worth it and said so at the time. This is the defect that slipped through — found while confirming the lucia fix actually worked, not by the review that never ran.

Worth noting it is the quiet kind: everything goes green, nothing alerts, the registry just does redundant work indefinitely.

Not covered

getHeadCommit has no unit test — it shells out to git ls-remote, and packages/registry has no test harness for build.ts or any network-touching code. Adding one means either a network-dependent test or mocking execSync, neither of which fits the existing test setup. Verified empirically against the live remote instead.

---

Generated by Claude Code

[changeset-bot]

⚠️ No Changeset found

Latest commit: ec26c55

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR