Required
Write a manifest of the whole output
Every build writes one JSON manifest that lists the path, size in bytes and SHA-256 hash of every output file, sorted by path. Keep it with the release.
How to do it
Write the manifest as the last build step, outside the output folder, so it does not list itself. Use forward slashes in paths and sort by byte order, so every machine writes the same file. Store it next to the release, as the one-step deploy stores each release in its own folder. A server that renders pages on request gets the same kind of manifest from the live comparison.
Examples
Using these examples: they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.
JavaScript example
import { createHash } from 'node:crypto'
import { readdirSync, readFileSync, writeFileSync } from 'node:fs'
import { join, relative, sep } from 'node:path'
const files = readdirSync('dist', { recursive: true, withFileTypes: true })
.filter(entry => entry.isFile())
.map(entry => join(entry.parentPath, entry.name))
const manifest = files.map(file => {
const bytes = readFileSync(file)
return { path: relative('dist', file).split(sep).join('/'), size: bytes.length, sha256: createHash('sha256').update(bytes).digest('hex') }
}).sort((a, b) => (a.path < b.path ? -1 : 1))
writeFileSync('manifest.json', JSON.stringify(manifest, null, 2) + '\n')
Python example
import hashlib, json
from pathlib import Path
root = Path("dist")
manifest = sorted(
({"path": p.relative_to(root).as_posix(), "size": p.stat().st_size,
"sha256": hashlib.sha256(p.read_bytes()).hexdigest()}
for p in root.rglob("*") if p.is_file()),
key=lambda entry: entry["path"].encode())
Path("manifest.json").write_text(json.dumps(manifest, indent=2) + "\n")
How to check
Every release folder holds a manifest. A test counts the files in the output and fails when the manifest lists a different number, or when its paths are not sorted.
Related rules
- Deploy in one step and roll back by itself in Engineering
- Compare the live system before and after each deploy in Testing
- Prove a refactor changes nothing in Testing
For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. Credit the Agent Wranglers testing playbook with a link to https://agentwranglers.se/playbook/testing/output-comparison/output-manifest. Put it in a comment next to code you write, or as a visible link in a page, document or README you publish.