Stop shipping build-only deps in the app - #23
Draft
mokagio wants to merge 1 commit into
Draft
Conversation
The renderer is esbuild-bundled at build time, so React, `@wordpress/*`, `@emotion/*`, and `xterm` are already inlined into `src/renderer`. Sitting in `dependencies`, electron-builder also shipped their full `node_modules` trees inside the app — dead weight the runtime never loads. Move them to `devDependencies` so packaging drops them, and remove `@xterm/xterm`, which has no references in `src` (the renderer imports the `xterm` package). Trims the packaged production tree from 1366 MB to 1196 MB (~170 MB, 12%). The bulk that remains is `@php-wasm` (PHP-WASM builds under `@wp-playground/cli`); reducing that needs a call on which PHP versions and execution strategies to support and is left as a follow-up. --- Generated with the help of Claude Code, https://claude.ai/code Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
mokagio
changed the base branch from
ainfra-2597-fix-macos-code-signing-for-contributor-toolkit
to
trunk
July 10, 2026 11:05
mokagio
force-pushed
the
mokagio/trim-desktop-artifact-deps
branch
from
July 10, 2026 11:05
b6ae55b to
1f8ca57
Compare
juanmaguitar
added a commit
that referenced
this pull request
Aug 10, 2026
) ## Why The app's user documentation is the README, and it has outgrown it: install steps, a ten-step walkthrough and the trunk-update rules all compete for the same page, and there is nowhere to put a screenshot. This PR gives the guide a home and a deploy pipeline. It carries no guide content beyond the landing page — that arrives in #232, and the harness that photographs the app in #231. ## What changes - `docs/` becomes a VitePress site with **its own npm package**, so a docs-only CI job never runs the root `postinstall` (electron-builder + esbuild) and the app's dependency tree stays free of a static-site generator. - `.github/workflows/docs.yml` builds and deploys to GitHub Pages on pushes to `trunk` that touch `docs/`. Pull requests get a **build-only** job: a dead link fails before merge, and the job holding the OIDC token never runs on PR code. - The site's `base` is derived from the repository name at run time. A project Pages site is served under `/<repo-name>/`, and this repo has already been renamed once — deriving it means another rename cannot break every asset URL. - `srcExclude` keeps `docs/testing.md` (from #70) out of the published site: it documents how to run the suites, which is contributor material, and this site is for users of the app. ## How to test this **Starting state:** this branch checked out, `npm ci` done. 1. `npm run docs:build` — expect `build complete`. Now add a link to a page that does not exist in `docs/index.md` and run it again: it must **fail** with `dead link(s) found`. Undo. 2. `npm run docs:preview`, open the printed URL — the home page renders with the WordPress Contributor Toolkit hero and the sidebar. Clean URLs work; this is exactly what Pages serves. 3. `npm run docs:dev` — pages are served at their `.html` paths in dev (`/index.html`). With the dev server open, run `npm run docs:build` in another terminal: the dev server must **not** spew reload lines (it ignores its own output directory). 4. `npm run lint` and `npm test` — both green, unchanged from `trunk`. **Must not have happened:** no `deploy` job may run on this pull request — check the Actions tab and confirm only `build site` ran. **Not testable by hand here:** the deploy itself. It needs the workflow on `trunk`, and Pages is already set to "GitHub Actions" as its source. ## Risks Merging this alone deploys a site whose sidebar names the full guide, so **those links 404 until the content PR lands**. Merge the stack in order rather than leaving this on `trunk` by itself. The deploy job holds `pages: write` and `id-token: write`. Its actions are pinned to commit SHAs rather than tags, following the reasoning already written down in `download-stats.yml`. ## Related Stack: this → #231 (screenshot harness) → #232 (guide content). Touches #70 only through `srcExclude`; that PR needs no change. --- <details> <summary><b>Self-review</b> — 5 findings, all fixed</summary> Ran `.github/instructions/code-review.instructions.md` with the judgement pass in a fresh context. Deterministic layer was clean (ESLint and the unit suite on macOS and Windows). **5 [fix here] · 1 [follow-up]. All five fixed in this branch:** | Dimension | Was | Now | |---|---|---| | security 🟡 | `checkout` kept the job's `GITHUB_TOKEN` in `.git/config` while the job runs PR-authored code (`npm ci` with lifecycle scripts, and a VitePress build that evaluates `config.mjs`) | `persist-credentials: false`, matching `lint.yml` | | security 🔵 | `if: github.event_name != 'pull_request'` let a `workflow_dispatch` on any ref publish to the live site, which is not what the comment claimed | `if: github.ref == 'refs/heads/trunk'` | | cross-platform 🔵 | `node-version: 22` hardcoded while `.nvmrc` says 24.18.0 — reintroducing the Node drift of #37/#46 for the one command CONTRIBUTING calls "what CI runs" | `node-version-file: .nvmrc` | | architecture 🔵 | one concurrency group spanning build and deploy, with `cancel-in-progress: true`, so a second push could cancel an in-flight `deploy-pages` | split: builds cancel, deploys do not | | architecture 🔵 | CONTRIBUTING documented `docs:*` without saying the nested package needs its own install, so the commands fail on a clean clone | `npm ci --prefix docs` documented | **Deferred [follow-up]:** `electron-builder` has no `files` filter, so tracked `docs/` sources ship inside `app.asar` — and #232 adds screenshots on top. Real, pre-existing, and overlaps #23; an `!docs{,/**/*}` entry closes it. Not done here because it changes what every release artifact contains, which deserves its own PR and its own testing. **Checked and clean:** all four action pins resolve to the tags their comments claim (verified against the GitHub API); `pull_request_target` is correctly not used and no fork PR can reach `pages: write` / `id-token: write`; the lockfile is 175 packages, all from registry.npmjs.org, with install scripts only on esbuild and fsevents; the `import/no-unresolved` exemption is a genuine false positive and hides nothing; no `src/` code, IPC surface or spawn path is touched. </details>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Stacked on #22 (macOS code signing). Review/merge that first — GitHub will retarget this to
trunkonce it lands.Rationale
The packaged app was ~1 GB on every platform. The renderer is esbuild-bundled at build time, so React,
@wordpress/*,@emotion/*, andxtermare already inlined intosrc/renderer— yet they also sat independencies, so electron-builder shipped their fullnode_modulestrees inside the app too.@xterm/xtermwas a dependency with zero references insrc(the renderer imports thextermpackage).Moving the build-only libs to
devDependenciesand dropping@xterm/xtermtrims the packaged production tree 1366 MB → 1196 MB (~170 MB, 12%), 492 → 312 packages.Not addressed here
The remaining bulk is
@php-wasm(~1 GB:@php-wasm/node654 MB +@php-wasm/web406 MB), pulled transitively by@wp-playground/cli. It ships every PHP version (7.2–8.4) in two execution strategies (asyncify + jspi), plus a browser build (@php-wasm/web) thatsrcnever imports directly. Cutting it needs a product decision on supported PHP versions/strategies and whether@php-wasm/webis reachable — left as a follow-up.How to test
electron-store(runtimeimport()), the main process,preload.js, and the spawned runner scripts were checked — none import the moved libraries.npm run build:oncebundles the renderer cleanly with the libs as devDependencies. Confirm the macOS/Windows/Linux builds still produce working apps and that artifact sizes drop by ~170 MB on the Buildkite run.