chore(ci): gate releases on configurable consumer builds

[bhabalan]

COMPLETES

Adds the requested consumer bundler release checks as a follow-up to #751. No separate issue was supplied.

This pull request addresses

A package can pass the repo's Webpack build and still fail when a host app uses another bundler. The wellness media regression is one example. We need to check consumer builds before publishing a release, and make each bundler check configurable.

Dependency: merge #751 first. This branch starts from next at c298215c and includes only the workflow, fixtures, tests, and documentation. It does not include the media fix. Current next fails the new Vite check as expected.

by making the following changes

• Add a read-only consumer workflow for PRs to next and for release checks.
• Use one checked-in tooling/consumer-builds/config.json file for both paths. Webpack, Vite, Parcel, Rollup, and esbuild are enabled by default. Set a bundler's enabled flag to false to omit its check. Invalid flags and disabling all five fail validation.
• Build and pack release candidates once, then install the nine Contact Center archives into a separate consumer fixture for each enabled bundler.
• Check public React imports, direct AI Assistant imports, and Web Component registration in Chromium below a nested URL. Use normal CSS, Sass, font, and image support, with no wellness media loader or raw media copy workaround.
• Require all enabled checks to pass before npm publishing. Publish the changed packages from the tested archives after checking their SHA-256 hashes and embedded package identities again. Keep the existing release version outputs and distributable cache for downstream jobs.
• Keep publishing credentials out of preparation and consumer jobs. Only the publish step receives the npm token. Preserve the existing exclusion of @webex/test-fixtures from npm publishing.
• Pin the consumer tools and UI peers in an independent fixture lockfile. Save failure logs and package hashes as workflow artifacts.
• Add configuration, archive, runner, browser, and workflow regression tests, plus the standing ai-docs/CONSUMER_BUILDS.md document and its spec index links.

Change Type

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update
• Tooling change
• Internal code refactor

The following scenarios were tested

• The testing is done with the amplify link
• Immutable Yarn install, development build, and production build on this branch.
• Production next candidate: Vite rejected the exact !!./emit-wellness-asset.cjs!./WellnessBreakSound.mp3 request. Webpack passed. This proves that a passing repository Webpack build does not cover the regression.
• Production candidate archives from fix(cc-widgets): restore bundler compatibility for wellness media #751 at 645707ff: all five consumers passed their builds and browser startup checks. Each result matched the SHA-256 hashes for the same nine archives. No source changes from fix(cc-widgets): restore bundler compatibility for wellness media #751 were added to this branch.
• Parcel opt out: changing its flag to false removed it from the matrix, and a direct Parcel invocation failed before installation. Restored all five default flags.
• 51 new tooling tests passed. Helper coverage: 88.96% lines, 84.09% branches. Tests cover invalid and empty configurations, archive tampering, package identity, build failure, browser failure, cleanup, and the release dependency graph.
• Full pre-commit hook passed without a bypass: 1,836 test executions across 94 suite executions, plus seven existing skips. The root script runs the meetings suite twice. Styles passed with zero errors and six existing warnings in the unchanged Web Component sample.
• actionlint, Prettier checks, immutable install after edits, staged secret-pattern scan, and git diff --check.
• npm publish dry runs passed for all nine Contact Center archives. A legacy package archive with a test prerelease version also passed and retained the next dist tag. An already-published legacy version was rejected as expected. No package was published.

Consumer	Pinned version	Production build and browser startup with #751 archives
Webpack	5.111.1	Passed
Vite	8.3.4	Passed
Parcel	2.16.4	Passed
Rollup	4.64.5	Passed
esbuild	0.28.2	Passed

Browser: Playwright 1.64.0 and Chromium 156.0.8078.4. These checks cover the fixture and pinned versions. They do not cover all consumer configurations, development servers, media playback, CSP policies, or authenticated agent sessions. GitHub Actions execution has not yet been verified. The existing fork PR CI also needs a code owner to add the validated label.

Testing and configuration: ai-docs/CONSUMER_BUILDS.md.

Rollback: revert this workflow change. To omit one bundler check, change its config flag.

The GAI Coding Policy And Copyright Annotation Best Practices

• GAI was not used (or, no additional notation is required)
• Code was generated entirely by GAI
  • GAI Coding Policy and Copyright Annotation Best Practices: OpenAI Codex generated the code, tests, and documentation. Existing copyright notices are retained. Human review is required before merge.
• GAI was used to create a draft that was subsequently customized or modified
• Coder created a draft manually that was non-substantively modified by GAI (e.g., refactoring was performed by GAI on manually written code)
• Tool used for AI assistance (GitHub Copilot / Other - specify)
  • Github Copilot
  • Other - OpenAI Codex
• This PR is related to
  • Feature
  • Defect fix
  • Tech Debt
  • Automation

Checklist before merging

• I have not skipped any automated checks
• All existing and new tests passed
  • All local unit, style, and fixed-candidate consumer tests passed. The default next consumer candidate must remain failing until fix(cc-widgets): restore bundler compatibility for wellness media #751 merges. GitHub checks are pending.
• I have updated the testing document
• I have tested the functionality with amplify link

---

Make sure to have followed the contributing guidelines before submitting.

[aws-amplify-us-east-2]

This pull request is automatically being deployed by Amplify Hosting (learn more).

Access this pull request here: https://pr-752.d1b38q61t1z947.amplifyapp.com