From 5387c3ef144934d3a9c399c1451bc986b9eeb296 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Pawe=C5=82=20Kuna?=
 <1282324+codecalm@users.noreply.github.com>
Date: Mon, 5 Oct 2026 00:15:09 +0200
Subject: [PATCH] Use frozen lockfile and run build script tests in CI, make
 webfont builds reproducible (#1624)

---
 .github/workflows/build.yml                 | 11 ++++++++++-
 .github/workflows/validate-pr.yml           |  2 +-
 package.json                                |  2 +-
 packages/icons-webfont/.build/utilities.mjs |  7 ++++++-
 4 files changed, 18 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 3b6b53a10..f16d7349c 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -44,7 +44,16 @@ jobs:
             ${{ runner.os }}-pnpm-store-
 
       - name: Install dependencies
-        run: pnpm install --no-frozen-lockfile
+        run: pnpm install --frozen-lockfile
+
+      - name: Lint
+        run: pnpm run lint
+
+      - name: Check formatting
+        run: pnpm run format:check
+
+      - name: Test build scripts
+        run: pnpm run test:build
 
       - name: Lint
         run: pnpm run lint
diff --git a/.github/workflows/validate-pr.yml b/.github/workflows/validate-pr.yml
index 112c2bfbe..263ca0339 100644
--- a/.github/workflows/validate-pr.yml
+++ b/.github/workflows/validate-pr.yml
@@ -65,7 +65,7 @@ jobs:
             ${{ runner.os }}-pnpm-store-
 
       - name: Install dependencies
-        run: pnpm install --no-frozen-lockfile
+        run: pnpm install --frozen-lockfile
 
       - name: Validate icons
         id: validate
diff --git a/package.json b/package.json
index 491024ca5..2fe610ca2 100644
--- a/package.json
+++ b/package.json
@@ -29,7 +29,7 @@
     "import": "node ./.build/import.mjs && pnpm run optimize",
     "import-tags": "node ./.build/import-tags.mjs",
     "import-categories": "node ./.build/import-categories.mjs",
-    "generate-preview": "pnpm run preview-icons && pnpm run preview-stroke",
+    "generate-preview": "pnpm run generate-preview-icons && pnpm run generate-preview-stroke",
     "generate-preview-icons": "node ./.build/preview-icons.mjs",
     "generate-preview-random-icons": "node ./.build/preview-random-icons.mjs",
     "generate-preview-stroke": "node ./.build/preview-stroke.mjs",
diff --git a/packages/icons-webfont/.build/utilities.mjs b/packages/icons-webfont/.build/utilities.mjs
index b8fa42bb5..788190350 100644
--- a/packages/icons-webfont/.build/utilities.mjs
+++ b/packages/icons-webfont/.build/utilities.mjs
@@ -110,6 +110,11 @@ export function removeComments(svgBuffer) {
   return svgBuffer;
 }
 
+// svg2ttf stamps fonts with the current time by default, which makes every
+// build produce different binaries. Use a fixed timestamp (overridable with
+// SOURCE_DATE_EPOCH) so identical icons give identical font files.
+const FONT_TIMESTAMP = process.env.SOURCE_DATE_EPOCH || 0;
+
 export function calculateHash(content) {
   return crypto.createHash('sha1').update(content).digest('hex');
 }
@@ -120,7 +125,7 @@ export async function generateFont(strokeName, type, DIR) {
     path.join(DIR, `icons-${type === 'outline' ? `outlined/${strokeName}` : 'filled'}`),
   );
   const svgFontFileSource = await buildSvgFont(svgFiles);
-  const ttfFile = Buffer.from(svg2ttf(svgFontFileSource).buffer);
+  const ttfFile = Buffer.from(svg2ttf(svgFontFileSource, { ts: FONT_TIMESTAMP }).buffer);
   const woffFile = Buffer.from(ttf2woff(ttfFile).buffer);
   const woff2File = await wawoff2.compress(ttfFile);