Validation: separate dsh-own-code diff from dependency-tree noise

Co-Authored-By: Claude Fable 5 <[email protected]>

.gitea/workflows/validate-suspect-image.yml

@@ -63,12 +63,20 @@ jobs:
           else
             echo "== package.json versions =="
             grep -E '"(name|version)"' "$SDIR/package.json" "$TDIR/package.json" | head -8
-            echo "== content diff of the dsh package (suspect vs trusted) =="
-            if diff -r "$SDIR" "$TDIR" > /tmp/dsh-diff.txt 2>&1; then
-              echo "IDENTICAL: suspect's dsh package matches the official npm release byte-for-byte"
+            echo "== dsh's OWN code (node_modules excluded) =="
+            if diff -r --exclude=node_modules "$SDIR" "$TDIR" > /tmp/dsh-own-diff.txt 2>&1; then
+              echo "IDENTICAL: suspect's dsh code matches the official npm release byte-for-byte"
             else
-              echo "DIFFERENCES FOUND:"
-              head -100 /tmp/dsh-diff.txt
+              echo "DSH CODE DIFFERENCES FOUND:"
+              cat /tmp/dsh-own-diff.txt
+            fi
+            echo "== dependency tree (node_modules) summary =="
+            if diff -r "$SDIR/node_modules" "$TDIR/node_modules" > /tmp/dsh-dep-diff.txt 2>&1; then
+              echo "dependencies identical"
+            else
+              echo "$(grep -c '^diff -r\|^Only in' /tmp/dsh-dep-diff.txt) differing/unique dependency files"
+              echo "-- packages with version changes --"
+              grep -A0 'package.json$' /tmp/dsh-dep-diff.txt | sed 's|.*node_modules/||; s|/package.json.*||' | sort -u | head -30
             fi
           fi