feat: support npm release history baselines

[jasonsaayman]

Summary

• Replace the arbitrary tarball-uri input with npm package-name release baseline resolution.
• Resolve the npm latest release plus up to 10 previous stable releases and include historical comparisons in the JSON report.
• Keep latest-release totals as the primary action outputs and render historical PR comment data inside a collapsed <details> section.
• Includes existing branch commits for Vite/Vitest/Oxlint migration and CI test reporting that are not yet on main.

Testing

• pnpm test
• pnpm run build
• pnpm run lint
• pnpm run typecheck

Checklist

• I updated tests or explained why no test changes are needed.
• I updated documentation when behavior, inputs, outputs, or workflow usage changed.
• I updated dist/index.js when runtime source, dependencies, or action metadata changed.
• I kept JSON report behavior machine-readable and backward-compatible unless intentionally changed.

Intentional compatibility note: this is a breaking input-contract change from tarball-uri to package-name, captured in the OpenSpec proposal.

---

Summary by cubic

Adds npm release baselines and historical comparisons: replace the tarball-uri input with package-name, compare against the npm latest release and up to 10 previous stable releases, and keep latest totals as the primary outputs. Also updates the repo CI to publish vitest test reports and coverage.

• New Features

  • Input change: package-name replaces tarball-uri (breaking).
  • Resolve npm metadata, download tarballs for latest + up to 10 previous stable releases, and compare gzip sizes for configured files.
  • Outputs still reflect the latest release; JSON adds packageName, baseline.version, and history[]; PR comments include a collapsed historical section.
  • Repo CI: add pnpm run test:ci using vitest + @vitest/coverage-v8, publish test report via dorny/test-reporter, and add a coverage summary.

• Migration

  • Update workflows to use package-name and keep files as-is.
  • If you parse the JSON report, handle the new fields (packageName, baseline.version, history) while existing totals remain unchanged.
  • Repo-only change: the PR workflow now needs checks: write for the test reporter; action consumers do not need this.

^{Written for commit 0f5a252. Summary will update on new commits. Review in cubic}

[cubic-dev-ai]

1 issue found across 53 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="src/config.ts">

<violation number="1" location="src/config.ts:24">
P2: Scoped package-name validation misses the `:` rejection, so invalid spec-like inputs (for example `@scope/name:latest`) are accepted.</violation>
</file>

_{Note: This PR contains a large number of files. Free-tier reviews are limited to 40 files per PR, so some files may not have been reviewed. cubic prioritizes the most important files to review. Paid plans can review more files.
You're on the cubic free plan with 9 free PR reviews remaining this month. Upgrade for unlimited reviews.
Re-trigger cubic}

[github-actions]

Bundle Size Report

Compared current build against latest npm release 7.0.0 for is-number.

File	Baseline gzip	Current gzip	Difference	Status
index.js	267 B	43 B	-224 B (-83.90%)	🟢
Total	267 B	43 B	-224 B (-83.90%)	🟢

Historical comparison: latest + 10 previous npm releases

Release	Baseline gzip	Current gzip	Difference	Status
7.0.0 latest	267 B	43 B	-224 B (-83.90%)	🟢
6.0.0	381 B	43 B	-338 B (-88.71%)	🟢
5.0.0	368 B	43 B	-325 B (-88.32%)	🟢
4.0.0	336 B	43 B	-293 B (-87.20%)	🟢
3.0.0	287 B	43 B	-244 B (-85.02%)	🟢
2.1.0	279 B	43 B	-236 B (-84.59%)	🟢
2.0.2	279 B	43 B	-236 B (-84.59%)	🟢
2.0.1	270 B	43 B	-227 B (-84.07%)	🟢
2.0.0	228 B	43 B	-185 B (-81.14%)	🟢
1.1.2	233 B	43 B	-190 B (-81.55%)	🟢
1.1.1	233 B	43 B	-190 B (-81.55%)	🟢