Shrink published package size - #924
Merged
Merged
Conversation
Build the proxy cert authority from the low-level @peculiar/asn1-* packages plus WebCrypto instead of the @peculiar/x509 prebundle, which inlined tsyringe + reflect-metadata and couldn't be tree-shaken. Drops ~264KB of bundled JS and its ~992KB vendor sourcemap. @peculiar/x509 is kept as a test-only devDependency to independently verify the certs we emit; added a test that runs a minted DNS-host leaf through Node TLS hostname verification. Also strip embedded third-party source text from release sourcemaps (node_modules sourcesContent), keeping mappings intact so frames still resolve and keeping our own source embedded. Runs on release builds only; local/dev builds keep full maps. Together these cut the release dist payload from ~6.6MB to ~5.1MB.
Contributor
|
The changes in this PR will be included in the next version bump.
|
commit: |
Switch the three semver call sites (plugin version matching + bun version check) from the default `import semver from 'semver'` to subpath imports (semver/functions/valid, ranges/valid, functions/satisfies, functions/gte). Same node-semver, identical range semantics, but lets the bundler tree-shake away the unused functions. Trims ~24KB from the startup path.
A measurement script (scripts/report-bundle-size.ts) plus two workflows that surface how a change moves varlock's published dist, so size creep like 1.12's gets caught at review time instead of after release. - report-bundle-size.ts: measures a built dist/ (total / JS / sourcemaps / type defs), emits markdown or JSON, and renders a delta table against a baseline. Also wired as a local `bun run bundle-size`. - bundle-size-check.yaml (unprivileged, pull_request): builds varlock in release mode, compares against a baseline (the base branch for normal PRs; the last published release for the bumpy version PR), writes the report to the job summary, and uploads it as an artifact. - bundle-size-comment.yaml (privileged, workflow_run): posts/updates a sticky PR comment from that artifact. Mirrors the fork-safe Bumpy check->comment split: never runs PR code, resolves the target PR from the trusted event, and treats the artifact body as text only.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Reduces the varlock npm package size, which grew notably in 1.12 with the proxy work, and adds CI so future creep is visible.
Size changes
Rebuild the proxy cert authority on low-level asn1 packages.
cert-authority.tsnow builds X.509 certs directly from@peculiar/asn1-x509/-schema/-eccplus native WebCrypto, instead of the@peculiar/x509prebundle. That prebundle inlined tsyringe + reflect-metadata and couldn't be tree-shaken, shipping as a ~436KB JS chunk plus a ~992KB sourcemap. The public API is unchanged (only the internalEphemeralCashape changed, and no external consumer used the removed field).@peculiar/x509is kept as a test-only devDependency to independently verify the DER we emit, plus a new test that runs a minted DNS-host leaf through Node's real TLS hostname verification.Strip third-party source text from release sourcemaps. A post-build step nulls out
sourcesContentfornode_modulessources while keeping allmappings(frames still resolve) and keeping our own source embedded (varlock's code stays debuggable). Release builds only; local/dev keep full maps.Import only the semver functions we use. Switched the three call sites (plugin version matching + bun version check) from
import semver from 'semver'to subpath imports. Same node-semver, identical range semantics, tree-shakes the rest. ~24KB off the startup path.Together these cut the release
dist/from ~6.6MB to ~5.1MB.Bundle-size reporting (new)
So this doesn't silently regress again:
scripts/report-bundle-size.tsmeasures a builtdist/(total / JS / sourcemaps / type defs) and renders a delta table vs a baseline. Runnable locally viabun run bundle-size.Bundle size check(unprivileged,pull_request): builds varlock in release mode and compares against a baseline, the base branch on normal PRs, or the last published release on the bumpy version PR, writes the report to the job summary, and uploads it as an artifact.Bundle size comment(privileged,workflow_run): posts/updates a sticky comment from that artifact. Mirrors the existing fork-safe Bumpy check->comment split (never runs PR code, resolves the PR from the trusted event, treats the artifact body as text only).Note: the normal-PR path rebuilds the base branch to get an exact per-PR delta, so it adds a build on varlock-touching PRs (path-filtered). Can be cached later if it drags.