fix(sdk): restore package.json copy for Vite SDK publish after nxViteTsPaths removal

[nicobytes]

Summary

• Restores explicit package.json (and README) copy into dist for @dotcms/analytics and @dotcms/vue via viteStaticCopy, replacing a hidden side effect of the removed nxViteTsPaths() plugin.
• Hardens the SDK NPM publish action to skip dist directories that have no package.json (e.g. analytics-standalone), so the publish loop does not fail with jq: Could not open file package.json.

Context

Trunk SDK @next publish failed on run 29416418823 after #36575 replaced nxViteTsPaths() with vite-tsconfig-paths. The Nx plugin copied package.json into the Vite outDir on writeBundle; the replacement does not. Publish then crashed while processing @dotcms/analytics after partially publishing ai, angular, and types as 1.7.1-next.2363.

Test plan

• pnpm exec nx build sdk-analytics --configuration=production — dist/libs/sdk/analytics/package.json present
• pnpm exec nx build sdk-vue --configuration=production — dist/libs/sdk/vue/package.json present
• After merge, next trunk deployment publishes a full coherent @next set (new run_number; do not re-run 2363)

This PR fixes: #36540

This PR fixes: #36540

[claude]

Claude finished @nicobytes's task in 5m 53s —— View job

---

Code Review

• Read PR diff (both vite configs + the two action.yml commits)
• Verify the package.json copy mechanism
• Check the publish-action hardening claim
• Post review

---

Summary

The core fix is sound. Both viteStaticCopy changes correctly restore the package.json copy that nxViteTsPaths() used to perform implicitly. src globs (*.md, package.json) resolve relative to each config's Vite root (__dirname / import.meta.dirname = the lib dir), and dest: '.' lands them at the outDir root — matching the pattern @dotcms/vue already used for *.md. The removed copyReadme fs plugin in analytics is fully subsumed by { src: '*.md', dest: '.' }, and its import fs is correctly dropped while path / react remain in use. vite-plugin-static-copy@4.1.1 is already a dependency. No bug in the two changed files.

New Issues

• 🟡 Medium: .github/actions/core-cicd/deployment/deploy-javascript-sdk/action.yml:206 — The PR description says it "hardens the SDK NPM publish action to skip dist directories that have no package.json," but that guard was added in a9ac78b4 and then removed again in 2fc80d44, so git diff origin/main...HEAD on action.yml is empty — the committed action is identical to main. The publish loop still runs jq -r '.version' package.json unconditionally (line 206) for every dir under dist/libs/sdk/. This is safe only because analytics-standalone is produced by the build:standalone target, and the publish build runs nx run-many --target=build --projects='sdk-*' (line 179) — which does not invoke build:standalone — so dist/libs/sdk/analytics-standalone is never present in a clean CI checkout.

  If that assumption ever changes (e.g. build:standalone becomes a dependency of build, or a stale/pre-populated dist is reused), the original jq: Could not open file package.json failure returns. Either re-add the skip guard to match the stated intent, or update the PR description to drop the hardening claim so reviewers aren't relying on a safety net that isn't in the merged code. Fix this →

Not blocking — the merged behavior is correct for the current build graph. Flagging only the description/code mismatch.

[mergify]

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

• Queue this pull request