more robust add git porcelain check too

.github/workflows/ci.yml

@@ -42,6 +42,9 @@ jobs:
     - run: yarn i18n:checks
     - run: yarn dogfood-lhci
 
+    # Fail if any changes were written to any source files or generated untracked files (ex, from: build/build-cdt-lib.js).
+    - run: git add -A && git diff --exit-code
+
     # buildtracker runs `git merge-base HEAD origin/master` which needs more history than depth=1. https://github.com/paularmstrong/build-tracker/issues/106
     - name: Deepen git fetch (for buildtracker)
       run: git fetch --deepen=100
@@ -58,9 +61,6 @@ jobs:
         name: dist
         path: dist/
 
-    # Fail if any changes were written to source files (ex, from: build/build-cdt-lib.js).
-    - run: git diff --exit-code
-
   # `unit` includes just unit and proto tests.
   unit:
     strategy:
@@ -111,8 +111,8 @@ jobs:
     - run: yarn diff:sample-json
       if: matrix.os == 'windows-latest'
 
-    # Fail if any changes were written to source files (ex, from -GA).
-    - run: git diff --exit-code
+    # Fail if any changes were written to any source files or generated untracked files (ex, from -GA).
+    - run: git add -A && git diff --exit-code
 
   # `smoke` runs as a matrix across 4 jobs:
   #  * The smoketest groups are split across two runners, to parallelize.
@@ -155,6 +155,9 @@ jobs:
     - name: Run smoke tests
       run: xvfb-run --auto-servernum yarn smoke --debug -j=1 --retries=2 --invert-match ${{ matrix.smoke-test-invert }} $SMOKE_GROUP_1
 
+    # Fail if any changes were written to source files.
+    - run: git diff --exit-code
+
   # Only run smoke tests for windows against stable chrome.
   smoke-windows:
     runs-on: windows-latest
@@ -193,3 +196,6 @@ jobs:
     - run: sudo apt-get install xvfb
     - name: yarn test-bundle
       run: xvfb-run --auto-servernum yarn test-bundle
+
+    # Fail if any changes were written to source files.
+    - run: git diff --exit-code