chore(deps-dev): bump the dev-dependencies group across 1 directory with 3 updates #477
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Bundle Analysis | |
| # Codecov Bundle Analysis. Tracks the size of `dist/index.js` (the | |
| # tsup/esbuild ESM output we publish to npm) over time so a PR that | |
| # accidentally adds a heavy dependency or stops tree-shaking surfaces | |
| # in the Codecov "Bundles" tab. Read-only on this repo's permissions | |
| # beyond contents:read; the upload uses the SAME `CODECOV_TOKEN` | |
| # secret the coverage upload in `ci.yml` already consumes — Codecov's | |
| # repo upload token is feature-agnostic (covers coverage, bundle | |
| # analysis, and test analytics from a single secret), so no new | |
| # secret to provision. | |
| on: | |
| push: | |
| branches: [main] | |
| # Also snapshot on every release tag (`v*`) so the Codecov | |
| # "Bundles" tab carries a labelled entry per release alongside | |
| # the per-commit history from main / PRs. | |
| tags: ["v*"] | |
| pull_request: | |
| branches: [main] | |
| merge_group: | |
| permissions: | |
| contents: read | |
| id-token: write # OIDC tokenless upload to Codecov | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| bundle-analysis: | |
| name: Bundle Analysis | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - name: Setup Node 22 | |
| uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 | |
| with: | |
| node-version: "22" | |
| cache: "npm" | |
| - name: Install dependencies | |
| run: npm ci | |
| - name: Build | |
| run: npm run build | |
| - name: Upload bundle stats to Codecov (OIDC, tokenless) | |
| # OIDC tokenless upload — the job claims `id-token: write` above, | |
| # codecov reads `codecov-bundle.json` to enable the GitHub Actions | |
| # OIDC exchange. Aligned with ci.yml's coverage upload pattern. | |
| # Pinned package version: a floating `npx @codecov/bundle-analyzer` | |
| # would bypass package-lock determinism and pull whatever is | |
| # published at CI time. | |
| run: | | |
| npx @codecov/bundle-analyzer@2.0.1 dist \ | |
| --config-file=codecov-bundle.json \ | |
| --bundle-name gmail-mcp |