ci: test supported runtimes and packed package

.github/workflows/ci.yml

@@ -42,6 +42,12 @@ jobs:
       - run: npm run check:links
       - name: Build tested npm package
         run: mkdir -p artifacts && npm pack --pack-destination artifacts
+      - name: Smoke-test the packed npm package
+        run: |
+          package_dir="$(mktemp -d)"
+          npm install --prefix "$package_dir" --no-save "./artifacts/"*.tgz
+          "$package_dir/node_modules/.bin/mdfmt" --version
+          "$package_dir/node_modules/.bin/mdfmt" --check README.md
       - name: Upload tested npm package
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
         with:
@@ -55,7 +61,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        node-version: ['24.x', '25.x']
+        node-version: ['24.x', '26.x']
     env:
       CHECK_BASE_REF: origin/main
       GH_TOKEN: ${{ github.token }}

README.md

@@ -447,11 +447,12 @@ runtime or formatting behavior changes.
 ### CI and pull requests
 
 Every pull request must pass the deterministic `lint` gate and both runtime
-matrix jobs (`test (24.x)` and `test (25.x)`). The lint gate runs formatting,
+matrix jobs (`test (24.x)` and `test (26.x)`). The lint gate runs formatting,
 payload synchronization, dependency audit, offline link checks, and builds the
-single npm tarball used by publishing; the runtime jobs focus on the test suite
-across supported Node versions. Publishing is allowed only after all three
-gates succeed.
+single npm tarball used by publishing. It also installs that tarball into a
+clean temporary prefix and exercises the packaged `mdfmt` binary; the runtime
+jobs focus on the test suite across supported Node versions. Publishing is
+allowed only after all three gates succeed.
 
 Live HTTP checks are intentionally not required for pull requests. The
 `external-contracts` job runs weekly and on demand from the Actions tab, so an

scripts/validators/ci.js

@@ -40,6 +40,7 @@ function validateCi(files) {
     { pattern: /actions\/upload-artifact@/i, label: "uploads the tested npm package" },
     { pattern: /actions\/download-artifact@/i, label: "publishes the tested npm package artifact" },
     { pattern: /npm\s+publish\s+(?:\.\/)?artifacts\/\*\.tgz/i, label: "publishes the tested npm tarball" },
+    { pattern: /Smoke-test the packed npm package/i, label: "smoke-tests the packed npm package" },
     { pattern: /npm\s+ci/i, label: "installs repository dependencies" },
     { pattern: /CHECK_BASE_REF/i, label: "sets CHECK_BASE_REF for release-drift checks" },
     { pattern: /fetch-depth:\s*0/i, label: "uses full git depth for diff history in precheck" },
@@ -58,6 +59,9 @@ function validateCi(files) {
   if (!/needs:\s*\[\s*test\s*,\s*lint\s*\]/i.test(ci)) {
     warnings.push("ci.yml: publish should require both test and lint jobs");
   }
+  if (!/node-version:\s*\['24\.x',\s*'26\.x'\]/i.test(ci)) {
+    warnings.push("ci.yml: test matrix should cover the declared Node >=24 floor and current 26.x runtime");
+  }
 
   // .node-version alignment
   const nodeVersionContent = read(".node-version");