From 0580bc9068b042e6d1557dea298005139a572cae Mon Sep 17 00:00:00 2001
From: Chinesezjc <jczhai@deepseek.com>
Date: Wed, 22 Jul 2026 15:30:53 +0800
Subject: [PATCH] fix(ci): reject partially parsed concurrency limits

Number.parseInt accepts a numeric prefix, so values like 1.5 or 8junk
silently ran an unintended worker count. Require the full string to
round-trip (same pattern as run-gates' positiveIntArg).
---
 scripts/verify-built-package-invariants.mjs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/scripts/verify-built-package-invariants.mjs b/scripts/verify-built-package-invariants.mjs
index 7b9aa0c187..7412404a97 100644
--- a/scripts/verify-built-package-invariants.mjs
+++ b/scripts/verify-built-package-invariants.mjs
@@ -33,7 +33,7 @@ function probeConcurrency(total) {
   const raw = process.env[CONCURRENCY_ENV]
   if (raw !== undefined && raw !== '') {
     const parsed = Number.parseInt(raw, 10)
-    if (!Number.isSafeInteger(parsed) || parsed < 1) {
+    if (!Number.isSafeInteger(parsed) || parsed < 1 || String(parsed) !== raw) {
       throw new Error(`verify-built-package-invariants: ${CONCURRENCY_ENV} must be a positive integer, got ${JSON.stringify(raw)}.`)
     }
     return Math.min(total, parsed)