.github/workflows/compressed-diff.yml (4)

21-27: Cache both lockfiles and switch to npm ci for reproducible installs.

This enables caching for the Premium repo too and speeds installs while enforcing the lockfile.

       with:
         node-version: 18.x
         cache: 'npm'
+        cache-dependency-path: |
+          package-lock.json
+          pro__premium_only/package-lock.json
-    - name: Install Dependencies
+    - name: Install Dependencies
       run: |
-        npm install
-        cd pro__premium_only && npm install
+        npm ci
+        cd pro__premium_only && npm ci

Please confirm both lockfiles are committed; otherwise npm ci will fail.

---

12-13: Ensure adequate git history for compressed-size comparisons.

Add fetch-depth: 2 to the main checkout so the action can diff against the base; keep the Premium checkout shallow.

-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v4
+      with:
+        fetch-depth: 2
-    - uses: actions/checkout@v4 # Checkout the Stackable Premium repo.
+    - uses: actions/checkout@v4 # Checkout the Stackable Premium repo.
       with:
         repository: 'bfintal/Stackable-Premium'
         ref: 'v3'
         path: 'pro__premium_only'
         token: '${{ secrets.ACCESS_KEY }}'
+        fetch-depth: 1

If compressed-size-action doesn’t require history in your setup, feel free to skip this.

Also applies to: 14-18

---

14-18: Limit secret scope (defense-in-depth).

Confirm ACCESS_KEY is a fine‑grained, read‑only PAT restricted to the Stackable‑Premium repo. Rotate if broader.

---

12-13: Optional: Pin actions to commit SHAs.

For supply-chain hardening, pin actions (checkout, setup-node, compressed-size-action) to immutable SHAs.

Also applies to: 19-21, 28-28

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

.github/workflows/compressed-diff.yml (1)

19-23: Unblock the workflow: upgrade setup-node to v4 (v3 is blocked on GH runners).

actionlint flags this and the job won’t run with v3. Update to v4.

-    - name: Setup Node
-      uses: actions/setup-node@v3
+    - name: Setup Node
+      uses: actions/setup-node@v4

Optional: consider node-version: 20.x to align with current LTS; verify build compatibility first.

.github/workflows/compressed-diff.yml (3)

21-23: Extend npm cache to include Premium lockfile.

Currently only the root lockfile is cached. Add both paths so installs in pro__premium_only benefit from cache as well.

       with:
-        node-version: 18.x
-        cache: 'npm'
+        node-version: 18.x
+        cache: 'npm'
+        cache-dependency-path: |
+          package-lock.json
+          pro__premium_only/package-lock.json

---

24-28: Verify lockfiles exist; consider minor install hardening.

npm ci requires package-lock.json in both locations. Confirm both files are present. Optionally add --no-audit --no-fund to shave CI time/noise.

-        npm ci --legacy-peer-deps
+        npm ci --legacy-peer-deps --no-audit --no-fund
         cd pro__premium_only
-        npm ci --legacy-peer-deps
+        npm ci --legacy-peer-deps --no-audit --no-fund

---

12-13: Add explicit step names for clarity in logs.

Small DX tweak to make steps easier to spot.

-    - uses: actions/checkout@v4
-    - uses: actions/checkout@v4 # Checkout the Stackable Premium repo.
+    - name: Checkout Stackable
+      uses: actions/checkout@v4
+    - name: Checkout Stackable Premium
+      uses: actions/checkout@v4 # Checkout the Stackable Premium repo.

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

.github/workflows/compressed-diff.yml (1)

19-21: Upgrade setup-node to v4 (v3 is blocked on GH runners).

actionlint flags v3 as too old; this breaks the job. Move to v4.

-    - name: Setup Node
-      uses: actions/setup-node@v3
+    - name: Setup Node
+      uses: actions/setup-node@v4

.github/workflows/compressed-diff.yml (6)

22-23: Consider bumping Node to an LTS that’s still supported.

Node 18 reached EOL on 2025-04-30. Prefer 20.x (or 22.x if compatible).

-        node-version: 18.x
+        node-version: 20.x

Would you like me to verify build compatibility across 18/20/22 with a quick matrix on this job?

---

22-28: Cache both lockfiles to speed installs.

You install deps at repo root and in pro__premium_only. Add cache-dependency-path for both lockfiles so npm cache hits cover both.

       with:
         node-version: 20.x
         cache: 'npm'
+        cache-dependency-path: |
+          package-lock.json
+          pro__premium_only/package-lock.json

---

24-28: Prefer dedicated steps with working-directory over inline cd.

Minor readability win and cleaner logs. Functionally equivalent.

-    - name: Install Dependencies
-      run: |
-        npm ci
-        cd pro__premium_only
-        npm ci
+    - name: Install Dependencies (root)
+      run: npm ci
+    - name: Install Dependencies (premium)
+      working-directory: pro__premium_only
+      run: npm ci

---

32-36: Pin third‑party action to a commit SHA.

preactjs/compressed-size-action is a third-party action; pin to a specific SHA to reduce supply‑chain risk.

-    - uses: preactjs/compressed-size-action@v2
+    - uses: preactjs/compressed-size-action@<commit-sha>

I can fetch the latest stable v2 commit SHA if you want.

---

7-11: Tighten default permissions for the job.

Set minimal permissions for better security posture.

 jobs:
   build:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read

---

30-36: Configure compressed-size-action to handle installs and builds for both base and PR
Remove the standalone build step and pass your install- and build-scripts directly to the action:

-    - name: Build Project
-      run: npm run build:no-translate
-    - uses: preactjs/compressed-size-action@v2
+    - uses: preactjs/compressed-size-action@v2
       with:
         repo-token: "${{ secrets.GITHUB_TOKEN }}"
         pattern: "./build/stackable/**"
         exclude: "{**/*.map,**/node_modules/**}"
+        install-script: npm ci
+        build-script: npm run build:no-translate

The action will run your install-script and build-script for both the base ref and the PR head, ensuring accurate size baselines.

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

.github/workflows/compressed-diff.yml (1)

23-27: Upgrade setup-node to v4 and move off Node 18 (blocked/EOL).

actionlint flags v3 as blocked; Node 18 is EOL. Bump to v4 and use an LTS (20 or 22). Also cache the sub-repo’s lockfile for faster CI.

-    - name: Setup Node
-      uses: actions/setup-node@v3
+    - name: Setup Node
+      uses: actions/setup-node@v4
       with:
-        node-version: 18.x
+        node-version: 20.x
         cache: 'npm'
+        cache-dependency-path: |
+          package-lock.json
+          pro__premium_only/package-lock.json

.github/workflows/compressed-diff.yml (2)

28-31: Slim the apt install.

Minor: combine commands and avoid recommended extras to reduce time/image churn.

-    - name: Install Build Tools
-      run: |
-        sudo apt-get update
-        sudo apt-get install -y build-essential
+    - name: Install Build Tools
+      run: sudo apt-get update && sudo apt-get install -y --no-install-recommends build-essential

---

32-36: Split installs, use working-directory, and skip premium deps on forks.

Improves clarity, avoids cd, and prevents failures when secrets aren’t available on fork PRs.

-    - name: Install Dependencies
-      run: |
-        npm ci --legacy-peer-deps
-        cd pro__premium_only
-        npm ci --legacy-peer-deps
+    - name: Install Dependencies (root)
+      run: npm ci --legacy-peer-deps --no-audit --no-fund
+
+    - name: Install Premium Dependencies
+      if: ${{ !github.event.pull_request.head.repo.fork }}
+      working-directory: pro__premium_only
+      run: npm ci --legacy-peer-deps --no-audit --no-fund

Confirm the workflow must build the premium package for all PRs; if not, we can fully skip those steps on forks.

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

.github/workflows/build-size-comparison.yml (8)

23-38: Premium repo checkout uses secrets; add explicit guards per step (defense-in-depth).

Even with a job-level guard, also gate these steps so local/manual runs don’t accidentally fail.

-    - name: Checkout Premium Repo (Current PR)
+    - name: Checkout Premium Repo (Current PR)
+      if: ${{ github.event.pull_request.head.repo.fork == false }}
       uses: actions/checkout@v4
       with:
         repository: 'bfintal/Stackable-Premium'
         ref: 'v3'
         path: 'pro__premium_only'
         token: '${{ secrets.ACCESS_KEY }}'

-    - name: Checkout Premium Repo (Base Branch)
+    - name: Checkout Premium Repo (Base Branch)
+      if: ${{ github.event.pull_request.head.repo.fork == false }}
       uses: actions/checkout@v4
       with:
         repository: 'bfintal/Stackable-Premium'
         ref: 'v3'
         path: 'base-branch/pro__premium_only'
         token: '${{ secrets.ACCESS_KEY }}'

---

45-57: Prefer working-directory over cd; drop legacy flag if not required.

Minimize subshell churn and only keep --legacy-peer-deps if you truly need it.

-    - name: Install Dependencies (Current PR)
-      run: |
-        npm ci --legacy-peer-deps
-        cd pro__premium_only
-        npm ci --legacy-peer-deps
+    - name: Install Dependencies (Current PR - root)
+      run: npm ci --no-audit --no-fund
+    - name: Install Dependencies (Current PR - premium)
+      run: npm ci --no-audit --no-fund
+      working-directory: pro__premium_only
@@
-    - name: Install Dependencies (Base Branch)
-      run: |
-        cd base-branch
-        npm ci --legacy-peer-deps
-        cd pro__premium_only
-        npm ci --legacy-peer-deps
+    - name: Install Dependencies (Base Branch - root)
+      run: npm ci --no-audit --no-fund
+      working-directory: base-branch
+    - name: Install Dependencies (Base Branch - premium)
+      run: npm ci --no-audit --no-fund
+      working-directory: base-branch/pro__premium_only

---

58-66: Set working-directory for builds.

Keeps paths consistent and avoids implicit state from previous cd’s.

-    - name: Build Current PR
-      run: |
-        npm run build:no-translate
+    - name: Build Current PR
+      run: npm run build:no-translate

-    - name: Build Base Branch
-      run: |
-        cd base-branch
-        npm run build:no-translate
+    - name: Build Base Branch
+      run: npm run build:no-translate
+      working-directory: base-branch

---

67-80: Use maximum compression and quieter zip; avoid fragile cd chains.

Also prepares for later path changes without breaking.

-    - name: Create Zip Files
-      run: |
-        # Create zip for current PR
-        cd build/stackable
-        zip -r ../../current-build.zip . -x "*.map" "node_modules/*"
-        
-        # Create zip for base branch
-        cd ../../base-branch/build/stackable
-        zip -r ../../../base-build.zip . -x "*.map" "node_modules/*"
-        
-        # Move zip files to root directory for easier access
-        cd ../../../
-        ls -la *.zip
+    - name: Create Zip Files
+      run: |
+        zip -r9q current-build.zip build/stackable -x "*.map" "node_modules/*"
+        zip -r9q base-build.zip   base-branch/build/stackable -x "*.map" "node_modules/*"
+        ls -la *.zip

---

123-130: Also list base-branch build contents for parity.

Helps quickly spot packaging differences.

         echo "### 📁 Build Contents" >> $GITHUB_STEP_SUMMARY
         echo "" >> $GITHUB_STEP_SUMMARY
         echo "**Current PR build contents:**" >> $GITHUB_STEP_SUMMARY
         echo '```' >> $GITHUB_STEP_SUMMARY
         unzip -l current-build.zip | head -20 >> $GITHUB_STEP_SUMMARY
         echo '```' >> $GITHUB_STEP_SUMMARY
+        echo "" >> $GITHUB_STEP_SUMMARY
+        echo "**Base Branch build contents:**" >> $GITHUB_STEP_SUMMARY
+        echo '```' >> $GITHUB_STEP_SUMMARY
+        unzip -l base-build.zip | head -20 >> $GITHUB_STEP_SUMMARY
+        echo '```' >> $GITHUB_STEP_SUMMARY

---

11-22: Lock workflow permissions to least privilege.

Not strictly required, but recommended.

 jobs:
   build-and-compare:
+    permissions:
+      contents: read
     runs-on: ubuntu-latest

---

72-76: Trim trailing spaces and add a newline at EOF.

Fix YAMLlint errors and keep diffs clean.

Also applies to: 85-85, 91-91, 96-96, 100-100, 104-104, 108-108, 114-114, 122-122, 138-138

---

23-30: Confirm secret scope and naming.

secrets.ACCESS_KEY should be a fine‑grained PAT with read access to bfintal/Stackable-Premium. Consider renaming to a repo-specific name (e.g., STACKABLE_PREMIUM_TOKEN) for clarity.

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

.github/workflows/build-size-comparison.yml (2)

8-9: Skip forked PRs to avoid secret access failures.

Forks don’t get org secrets; premium checkouts will fail. Gate the job.

 jobs:
   build-and-compare:
+    if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.fork == false }}
     runs-on: ubuntu-latest

---

39-44: Update setup-node action and Node version (v3 is disabled; Node 14 is EOL).

Use actions/setup-node@v4 with Node 20.x and cache all lockfiles.

-    - name: Setup Node
-      uses: actions/setup-node@v3
-      with:
-        node-version: 14.x
-        cache: 'npm'
+    - name: Setup Node
+      uses: actions/setup-node@v4
+      with:
+        node-version: 20.x
+        cache: npm
+        cache-dependency-path: |
+          package-lock.json
+          pro__premium_only/package-lock.json
+          base-branch/package-lock.json
+          base-branch/pro__premium_only/package-lock.json

.github/workflows/build-size-comparison.yml (3)

67-76: Zip exclude patterns miss nested source maps; quiet zip output.

Use recursive globs and keep quoting to avoid shell expansion.

-        cd build/stackable
-        zip -r ../../current-build.zip . -x "*.map" "node_modules/*"
+        cd build/stackable
+        zip -qr ../../current-build.zip . -x '**/*.map' '**/node_modules/*'
@@
-        cd ../../base-branch/build/stackable
-        zip -r ../../../base-build.zip . -x "*.map" "node_modules/*"
+        cd ../../base-branch/build/stackable
+        zip -qr ../../../base-build.zip . -x '**/*.map' '**/node_modules/*'

---

307-345: Use the hidden marker to upsert reliably and set a safer match.

Matching on user.type can miss cases; use the marker injected above.

-          const existingComment = comments.find(comment => 
-            comment.user.type === 'Bot' && 
-            comment.body.includes('📦 Build Size Comparison')
-          );
+          const MARKER = '<!-- build-size-comparison -->';
+          const existingComment = comments.find(c => c.body && c.body.includes(MARKER));

---

1-353: Clean trailing spaces and add a final newline.

YAMLlint flagged many trailing spaces and missing EOF newline; trim whitespace and ensure a newline at end of file.

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro