✨ Add post-build vendor safety check to prevent Vite define corruption by clubanderson · Pull Request #4252 · kubestellar/console

clubanderson · 2026-04-02T15:04:18Z

Adding or modifying a card/dashboard? Read the Card Development Guide first — it covers required patterns, common pitfalls, and the full file checklist.

New CNCF project card? New cards go in kubestellar/console-marketplace, not this repo. PRs adding new cards here will be redirected.

Use a coding agent. This repo is primarily developed with Claude Code (Opus 4.5/4.6). It knows all codebase patterns (isDemoData, useCardLoadingState, locale strings, DCO). Manual PRs that miss required patterns will be sent back.

📝 Summary of Changes

Adds a postbuild script (scripts/check-vendor-safety.mjs) that runs after every npm run build. It scans all vendor-related JS bundles in dist/assets/ for void 0( — the minified form of undefined() — which indicates Vite's define config replaced console.* calls in vendor/dependency code.

This would have caught the production crash from #4248 (caused by #4239) before the build ever deployed.

How it works

npm run build
  → tsc -b
  → vite build
  → node scripts/check-vendor-safety.mjs   ← NEW postbuild step

If vendor corruption is detected, the build fails with:

ERROR: vendor-xyz.js contains 3 `undefined()` calls.
  Vite's `define` config likely replaced `console.*` in vendor code.
  Only use `globalThis.console.*` in vite.config.ts define — never bare `console.*`.

Changes Made

Added web/scripts/check-vendor-safety.mjs — post-build script that scans vendor bundles for void 0( corruption pattern
Wired postbuild hook in web/package.json to run the safety check after every build
Removed unused UI constant import in web/src/components/layout/Layout.tsx
Fixed import.meta.dirname → dirname(fileURLToPath(import.meta.url)) for broad Node.js ESM compatibility
Broadened vendor file filter from vendor-*.js prefix to name.includes('vendor'), covering all Vite manual chunk names (react-vendor, ui-vendor, charts-vendor, vendor, etc.)

Checklist

Please ensure the following before submitting your PR:

I used a coding agent (Claude Code, Copilot, Gemini, or Codex) to generate/review this code
I have reviewed the project's contribution guidelines
New cards target console-marketplace, not this repo
isDemoData is wired correctly (cards show Demo badge when using demo data)
I have written unit tests for the changes (if applicable)
I have tested the changes locally and ensured they work as expected
All commits are signed with DCO (git commit -s)

Screenshots or Logs (if applicable)

> kubestellar-console@0.1.0 postbuild
> node scripts/check-vendor-safety.mjs

✓ Vendor bundle safety check passed

👀 Reviewer Notes

The file filter now uses name.includes('vendor') to catch all Vite chunk naming patterns (vendor-, react-vendor-, ui-vendor-, charts-vendor-, etc.) rather than only the vendor- prefix.
Path resolution uses dirname(fileURLToPath(import.meta.url)) instead of import.meta.dirname for compatibility with Node.js versions used in CI (v12.11+).

clubanderson · 2026-04-02T15:04:25Z

/lgtm
/approve

netlify · 2026-04-02T15:04:26Z

✅ Deploy Preview for kubestellarconsole ready!

Name	Link
🔨 Latest commit	`ef876db`
🔍 Latest deploy log	https://app.netlify.com/projects/kubestellarconsole/deploys/69ce93273c3999000834734d
😎 Deploy Preview	https://deploy-preview-4252.console-deploy-preview.kubestellar.io
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

kubestellar-prow · 2026-04-02T15:04:27Z

@clubanderson: you cannot LGTM your own PR.

Details

In response to this:

/lgtm
/approve

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

github-actions · 2026-04-02T15:04:30Z

👋 Hey @clubanderson — thanks for opening this PR!

🤖 This project is developed exclusively using AI coding assistants.

Please do not attempt to code anything for this project manually.
All contributions should be authored using an AI coding tool such as:

Claude Code (Opus 4.5 / 4.6) — recommended

GitHub Copilot

Cursor

Other AI coding assistants

This ensures consistency in code style, architecture patterns, test coverage,
and commit quality across the entire codebase.

This is an automated message.

kubestellar-prow · 2026-04-02T15:04:31Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: clubanderson

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [clubanderson]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

Copilot

Pull request overview

Adds a post-build guardrail in the web/ frontend build pipeline to detect Vite define-based corruption of dependency bundles (the “undefined(...) / void 0(” production crash class seen in #4248), ensuring the build fails before deployment if corrupted vendor chunks are produced.

Changes:

Add postbuild script that scans built assets for the void 0( pattern indicating undefined(...) calls in minified output.
Wire the safety check into npm run build via package.json postbuild.
Minor cleanup in Layout.tsx import list.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
web/src/components/layout/Layout.tsx	Removes an unused UI constant import.
web/scripts/check-vendor-safety.mjs	New post-build script to detect vendor bundle corruption patterns.
web/package.json	Adds `postbuild` hook to run the new safety check after builds.

Copilot · 2026-04-02T15:08:01Z

web/scripts/check-vendor-safety.mjs

+import { join } from 'node:path'
+
+const ASSETS_DIR = join(import.meta.dirname, '..', 'dist', 'assets')


import.meta.dirname is not a Node-standard ESM API and can be undefined depending on the Node version/flags. Since this runs as part of postbuild, a missing import.meta.dirname would crash the build before the check runs. Prefer deriving the script directory from import.meta.url (via fileURLToPath) or resolve dist/assets from process.cwd() to keep this compatible with the Node versions used in CI.

Suggested change

import { join } from 'node:path'

const ASSETS_DIR = join(import.meta.dirname, '..', 'dist', 'assets')

import { join, dirname } from 'node:path'

import { fileURLToPath } from 'node:url'

const __dirname = dirname(fileURLToPath(import.meta.url))

const ASSETS_DIR = join(__dirname, '..', 'dist', 'assets')

Copilot · 2026-04-02T15:08:02Z

web/scripts/check-vendor-safety.mjs

+const vendorFiles = readdirSync(ASSETS_DIR).filter(
+  (name) => name.startsWith('vendor-') && name.endsWith('.js'),
+)


The file filter only matches vendor-*.js, but the Vite config splits dependencies into multiple *-vendor chunks (e.g. react-vendor, ui-vendor, etc.). If define corruption happens in those chunks, this check will miss it and the build will still succeed. Consider scanning all *-vendor-*.js chunks (and/or all .js files in dist/assets) rather than only the vendor- prefix.

clubanderson · 2026-04-02T15:08:12Z

🔄 Auto-Applying Copilot Code Review

Copilot code review found 1 code suggestion(s) and 1 general comment(s).

@copilot Please apply all of the following code review suggestions:

web/scripts/check-vendor-safety.mjs (line 19): import { join, dirname } from 'node:path' import { fileURLToPath } from 'node:ur...

Also address these general comments:

web/scripts/check-vendor-safety.mjs (line 28): The file filter only matches vendor-*.js, but the Vite config splits dependencies into multiple *-vendor chunks (e.g

Push all fixes in a single commit. Run cd web && npm run build && npm run lint before committing.

Auto-generated by copilot-review-apply workflow.

Copilot · 2026-04-02T15:19:29Z

🔄 Auto-Applying Copilot Code Review

Copilot code review found 1 code suggestion(s) and 1 general comment(s)....

Applied both fixes in e2523e5:

import.meta.dirname → fileURLToPath: Replaced with dirname(fileURLToPath(import.meta.url)) for broad Node.js ESM compatibility.
Broadened vendor file filter: Changed from name.startsWith('vendor-') to name.includes('vendor'), which now covers all Vite chunk names (react-vendor, ui-vendor, charts-vendor, vendor, etc.).

Build and lint verified passing.

Adds a postbuild script that scans vendor bundles for `void 0(` — the minified form of `undefined()` — which indicates Vite's define config replaced `console.*` calls in dependency code. This would have caught the production crash from PR #4239 / #4248 before deployment. Also removes unused DEV_BAR_HEIGHT_PX import blocking tsc. Signed-off-by: Andrew Anderson <andy@clubanderson.com>

github-actions · 2026-04-02T16:08:33Z

Thank you for your contribution! Your PR has been merged.

Check out what's new:

KubeStellar Console — Live multi-cluster dashboard
Marketplace — Community extensions
Knowledge Base — Troubleshooting and how-tos

Stay connected: Slack #kubestellar-dev | Multi-Cluster Survey

Copilot AI review requested due to automatic review settings April 2, 2026 15:04

kubestellar-prow bot added the dco-signoff: yes Indicates the PR's author has signed the DCO. label Apr 2, 2026

kubestellar-prow bot added the size/M Denotes a PR that changes 30-99 lines, ignoring generated files. label Apr 2, 2026

kubestellar-prow bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Apr 2, 2026

Copilot started reviewing on behalf of clubanderson April 2, 2026 15:05 View session

Copilot AI reviewed Apr 2, 2026

View reviewed changes

clubanderson assigned Copilot Apr 2, 2026

Copilot started work on behalf of clubanderson April 2, 2026 15:08 View session

kubestellar-prow bot added dco-signoff: no Indicates the PR's author has not signed the DCO. and removed dco-signoff: yes Indicates the PR's author has signed the DCO. labels Apr 2, 2026

clubanderson force-pushed the fix/ci-vendor-crash-guard branch from e2523e5 to ef876db Compare April 2, 2026 16:02

kubestellar-prow bot added dco-signoff: yes Indicates the PR's author has signed the DCO. and removed dco-signoff: no Indicates the PR's author has not signed the DCO. labels Apr 2, 2026

clubanderson merged commit a00a61b into main Apr 2, 2026
19 of 22 checks passed

kubestellar-prow bot deleted the fix/ci-vendor-crash-guard branch April 2, 2026 16:08

Copilot finished work on behalf of clubanderson April 2, 2026 16:19

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

✨ Add post-build vendor safety check to prevent Vite define corruption#4252

✨ Add post-build vendor safety check to prevent Vite define corruption#4252
clubanderson merged 1 commit intomainfrom
fix/ci-vendor-crash-guard

clubanderson commented Apr 2, 2026 •

edited by Copilot AI

Loading

Uh oh!

clubanderson commented Apr 2, 2026

Uh oh!

netlify bot commented Apr 2, 2026 •

edited

Loading

Uh oh!

kubestellar-prow bot commented Apr 2, 2026

Uh oh!

github-actions bot commented Apr 2, 2026

Uh oh!

kubestellar-prow bot commented Apr 2, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Apr 2, 2026

Uh oh!

Copilot AI Apr 2, 2026

Uh oh!

clubanderson commented Apr 2, 2026

Uh oh!

Copilot AI commented Apr 2, 2026

🔄 Auto-Applying Copilot Code Review

Uh oh!

Uh oh!

github-actions bot commented Apr 2, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

		import { join } from 'node:path'

		const ASSETS_DIR = join(import.meta.dirname, '..', 'dist', 'assets')

-import { join } from 'node:path'
-const ASSETS_DIR = join(import.meta.dirname, '..', 'dist', 'assets')
+import { join, dirname } from 'node:path'
+import { fileURLToPath } from 'node:url'
+const __dirname = dirname(fileURLToPath(import.meta.url))
+const ASSETS_DIR = join(__dirname, '..', 'dist', 'assets')

Conversation

clubanderson commented Apr 2, 2026 • edited by Copilot AI Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

📝 Summary of Changes

How it works

Changes Made

Checklist

Screenshots or Logs (if applicable)

👀 Reviewer Notes

Uh oh!

clubanderson commented Apr 2, 2026

Uh oh!

netlify bot commented Apr 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for kubestellarconsole ready!

Uh oh!

kubestellar-prow bot commented Apr 2, 2026

Uh oh!

github-actions bot commented Apr 2, 2026

Uh oh!

kubestellar-prow bot commented Apr 2, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Apr 2, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 2, 2026

Choose a reason for hiding this comment

Uh oh!

clubanderson commented Apr 2, 2026

🔄 Auto-Applying Copilot Code Review

Uh oh!

Copilot AI commented Apr 2, 2026

🔄 Auto-Applying Copilot Code Review

Uh oh!

Uh oh!

github-actions bot commented Apr 2, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

clubanderson commented Apr 2, 2026 •

edited by Copilot AI

Loading

netlify bot commented Apr 2, 2026 •

edited

Loading