We use a relatively simple build. at the base of it, if you have node and npm, a complete build is as easy as

yarn npm login

yarn --immutable

yarn build

Personally - I don't really find it reasonable to place demands on build tooling for an external company.

I'm assuming you would also find it reasonable for Google to suddenly ship chromium with a requirement that you use "google-pack" for all js builds or they don't run it?

To be entirely blunt, what exactly do you think is going to change when we're already giving them bare JS? It's not like we're shipping a binary blob here, we're literally handing them a zip file with perfectly fine & inspectable javascript inside it.

Further, do you realistically believe that a single low grade QA/Support engineer who can't even install the correct tooling is going to catch malware?

Because I read their matrix chats and I can fucking promise they aren't catching the malware all that fast....