.github/workflows/ci.yml

@@ -146,7 +146,16 @@ jobs:
 
       - name: Alle PowerShell-Dateien mit Windows PowerShell 5.1 parsen
         shell: powershell
-        run: .\tools\verify-powershell-parser.ps1
+        run: .\tools\verify-powershell-parser.ps1 -ReportPath "$env:RUNNER_TEMP\powershell-parser-diagnostics.txt"
+
+      - name: Parserdiagnose bei Fehler sichern
+        if: failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: powershell-parser-diagnostics-${{ github.event.pull_request.head.sha || github.sha }}
+          path: ${{ runner.temp }}/powershell-parser-diagnostics.txt
+          if-no-files-found: error
+          retention-days: 14
 
       - name: Vollständigen Vendoo-Releasevertrag unter Windows ausführen
         shell: pwsh
@@ -202,9 +211,18 @@ jobs:
           if (manifest.targetVersion !== '1.43.0') throw new Error(`Unerwartete Zielversion: ${manifest.targetVersion}`);
           console.log(`Paket validiert: ${manifest.targetVersion}, Updater ${manifest.updaterVersion}, Payload ${manifest.payloadHash}`);
           NODE
+          archive="release-output/${release_name}.zip"
+          python tools/build-deterministic-zip.py "$package_dir" "$archive"
+          first_hash="$(sha256sum "$archive" | awk '{print $1}')"
+          python tools/build-deterministic-zip.py "$package_dir" "$archive"
+          second_hash="$(sha256sum "$archive" | awk '{print $1}')"
+          if [[ "$first_hash" != "$second_hash" ]]; then
+            echo "Der ZIP-Build ist nicht byte-reproduzierbar." >&2
+            exit 1
+          fi
+          python -m zipfile -t "$archive"
           (
             cd release-output
-            zip -qr "${release_name}.zip" "${release_name}"
             sha256sum "${release_name}.zip" > "${release_name}.zip.sha256"
             sha256sum --check "${release_name}.zip.sha256"
           )