Nothing builds the _dev bud pipeline, so assets/admin/js/* drifts silently

Found while surveying the JS build for #1215.

The problem

_dev/src/bulk.js and _dev/src/chart.js are compiled by bud/webpack into assets/admin/js/{bulk,chart,runtime}.js, per _dev/bud.config.js.

Nothing runs that build. Verified:

_dev/ has its own separate package.json (@roots/bud ^6.11.0) with its own build script, which a developer must remember to run by hand, in that directory.

Why it matters

assets/admin/js/*.js is committed build output (real commit history, most recently via #1208). So the shipped bundle is whatever the last person to run bud by hand happened to commit.

Concretely:

• A PR can change _dev/src/bulk.js and not rebuild. CI passes. The source and the shipped bundle silently disagree, and the source change simply has no effect in production.
• Nothing detects it. There is no CI check that the committed bundle matches its source.
• deploy-tag.yml performs no JS build, so whatever is committed is what reaches WordPress.org.

This is a live footgun rather than a hypothetical: the bulk optimization page is driven entirely by that bundle.

Suggested fix

Either:

1. Wire it in — have the root npm run build also run the bud build (npm --prefix _dev run build, or fold bud into the root package.json), and add a CI job that rebuilds and fails if git diff --exit-code assets/admin is dirty. That catches the drift at PR time.
2. Or build at release — add a JS build step to deploy-tag.yml and stop committing built output entirely. Note this is a bigger change than it looks: Composer installs (see #1073) also never run a JS build, so committed bundles would still be needed there unless that path is addressed too.

Option 1 is the smaller, safer change and fixes the immediate hazard.

Related

• #1215 — JS testing in CI; this was found while mapping that work. The two overlap: consolidating the pipelines there would naturally absorb this.
• #1073 — Composer installs never run a build, which constrains option 2.

Start with the root package.json, _dev/package.json, and _dev/bud.config.js, then inspect .github/workflows and deploy-tag.yml to confirm the current build paths. Wire the existing _dev build into the chosen workflow and add the proposed dirty-output check for assets/admin. Done means the relevant build runs automatically and detects committed bundles that differ from source.