[TheTisiboth]

Topic and Scope

Closes #3502

Adds Codecov bundle analysis with @codecov/vite-plugin. The plugin only runs on production builds (vite build) in GitHub Actions, and authenticates via GitHub OIDC (no upload token). The source-package job gets id-token: write for this. Local and dev/watch builds are unaffected. Plugin telemetry is disabled.

Concerns/issues

• Forks: GitHub does not issue OIDC tokens to fork PRs, so the plugin stays off there.
• Vite 7 override: the plugin declares vite 4–6 as peer dependency, the app uses vite 7. An npm overrides entry maps the peer to our vite version. Upstream issue: Support vite v7 codecov/codecov-javascript-bundler-plugins#264. Tested locally: the build works.
• Baseline: a new Bundle analysis workflow builds on each master push (no tests) to upload the baseline bundle stats. Coverage baseline stays in Reactivate Codecov actions on trunk branches  #3074.

Formal requirements

• I did check that the app can still be opened and does not throw any browser logs
• I created tests for newly added PHP code (check this if no PHP changes were made)
• I updated the OpenAPI specs and added an entry to the API changelog (check if API was not modified)
• I notified the matrix channel if I introduced an API change

AI disclosure

I used Ai for code gen

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

• Last reviewed commit: 8c97f80
• Latest commit, not reviewed: 13945d2

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

Walkthrough

The project adds the Codecov Vite plugin as a development dependency and configures Vite to enable bundle analysis for production builds when ACTIONS_ID_TOKEN_REQUEST_URL is truthy. The plugin uses the bundle name cookbook, GitHub OIDC, and disabled telemetry. The source-package job now grants contents: read and id-token: write permissions. A new workflow runs on pushes to master or manual dispatch, installs the Node.js and npm versions specified in package.json, installs dependencies, and runs the build.

Priority: Low

Merge Risk: Low · previous review 8c97f

Bundle analysis is mergeable with owner awareness, but dependency installation should eventually be isolated from the OIDC-enabled upload to protect Codecov data integrity.

Pre-merge checks: 4 · 1

Failed checks: 1 warning

Check name	Status	Explanation	Resolution
Linked Issues check		Issue #3502 requires installing and configuring Codecov Vite bundle analysis. The PR adds @codecov/vite-plugin, sets bundle name cookbook, and enables analysis for production builds with GitHub OI…	Configure the plugin with the issue's CODECOV_TOKEN and uploadToken requirements, or update issue #3502 to explicitly accept the implemented GitHub OIDC configuration as the replacement.

Passed checks: 4 passed

Check name	Status	Explanation
Title check		The title clearly and concisely identifies the main change: adding Codecov bundle analysis through the Vite plugin.
Description check		The description includes the required Topic and Scope, Concerns/issues, and Formal requirements sections. It explains the OIDC setup, workflow behavior, Vite override, fork behavior, testing, and API …
Out of Scope Changes check		The dependency, Vite plugin configuration, OIDC permission, and bundle-analysis workflow all support the bundle-analysis objective in issue #3502. The workflow installs dependencies and runs the produ…
Docstring Coverage		No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…

Full details: Description check

Explanation

The description includes the required Topic and Scope, Concerns/issues, and Formal requirements sections. It explains the OIDC setup, workflow behavior, Vite override, fork behavior, testing, and API impact.

Full details: Out of Scope Changes check

Explanation

The dependency, Vite plugin configuration, OIDC permission, and bundle-analysis workflow all support the bundle-analysis objective in issue #3502. The workflow installs dependencies and runs the production build that supplies the bundle data. No unrelated change is shown in the reviewed files.

Full details: Docstring Coverage

Explanation

No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 1 files. (1 skipped: 1 unsupported.)

Full details: Linked Issues check

Explanation

Issue #3502 requires installing and configuring Codecov Vite bundle analysis. The PR adds @codecov/vite-plugin, sets bundle name cookbook, and enables analysis for production builds with GitHub OIDC. However, the issue specifies CODECOV_TOKEN-based enablement and uploadToken: process.env.CODECOV_TOKEN. The reviewed configuration does not use either setting.

Resolution

Configure the plugin with the issue's CODECOV_TOKEN and uploadToken requirements, or update issue #3502 to explicitly accept the implemented GitHub OIDC configuration as the replacement.

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 2

Nitpick comments: 1

.github/workflows/tests.yml: 1

469-470: Trivial · Security & Privacy · Quick win

Pin the source-package job to least-privilege permissions.

The job runs for both pull_request and workflow_dispatch, checks out code, and runs make npm with CODECOV_TOKEN. Without permissions, its GITHUB_TOKEN scopes depend on repository or organization defaults. A manual dispatch is not subject to the fork pull-request read-only adjustment.

This does not prove that the current repository default grants write access, but the workflow should not depend on that external setting.

Suggested fix

   source-package:
     name: Create source code artifacts
     runs-on: ubuntu-latest
+    permissions:
+      contents: read

---

Review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 10a2f55c-fd6d-4769-87c7-8071955ca1b1

Commits

Reviewing files that changed from the base of the PR and between 56213cf and df92407.

Files ignored due to path filters: 1

• package-lock.json is excluded by !**/package-lock.json

Files selected for processing: 3

• .github/workflows/tests.yml
• package.json
• vite.config.js

Included review availability: This review used your included allowance. Your plan provides up to 4 included reviews per hour; 3 remain after this review.

[github-actions]

Test Results

   12 files    600 suites   2m 42s ⏱️
  605 tests   597 ✅  8 💤 0 ❌
2 420 runs  2 387 ✅ 33 💤 0 ❌

Results for commit 13945d2.

♻️ This comment has been updated with latest results.

[TheTisiboth]

@christianlupus the plugin is in place, but nothing gets uploaded yet. CODECOV_TOKEN is only set up for the codecov environment, which is limited to master, so PR builds get an empty token.

Would you be OK with making it available to PR builds? Either:

• add CODECOV_TOKEN as a repo secret, or
• allow all branches in the codecov environment (fork are not supported, which is what is wanted)

If you don't want to change the token scope, there is an other option actually:
Leave the token as it is and we could upload from the "Annotate test results" workflow, the same way coverage is uploaded, using Codecov's bundle analyzer on the built app. No token change, no vite override, but we only get file sizes, without the module breakdown (so less detailed report)

[christianlupus]

Cannot we use oidc instead of classical tokens to authenticate? That would make the process much more robust, I guess.

[coderabbitai]

Actionable comments posted: 1

---

Review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: fdbc30ee-e7f3-42df-b427-a52dd42987c0

Commits

Reviewing files that changed from the base of the PR and between aa85fc8 and 13437fb.

Files selected for processing: 2

• .github/workflows/tests.yml
• vite.config.js

Included review availability: This review used your included allowance. Your plan provides up to 4 included reviews per hour; 3 remain after this review.

[TheTisiboth]

upload with oidc worked (in Build node app section, it says: [codecov] Successfully uploaded stats for bundle: cookbook-esm

[coderabbitai]

Actionable comments posted: 1

Caution

Some comments are outside the diff and can’t be posted inline due to GitHub limitations.

⚠️ Outside diff range comments (1)

Minor · Disable lifecycle scripts during dependency installation. · tests.yml:409-411

.github/workflows/tests.yml:409-411
🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win

Disable lifecycle scripts during dependency installation.

Removing id-token: write disables the intended Codecov upload because vite.config.js requires ACTIONS_ID_TOKEN_REQUEST_URL. Keep the permission for make npm, but prevent dependency lifecycle scripts from running with it:

Suggested fix

         -   name: Install the NPM dependencies
             shell: bash
             run: >-
-                npm ci
+                npm ci --ignore-scripts

The locked esbuild packages still obtain the Linux binary through optional dependencies when scripts are disabled. The other install-script packages are optional platform support or unrelated development dependencies. The production command has no pre-build or post-build hook, so this preserves the intended build and upload flow.

A compromised dependency could otherwise upload forged bundle metrics. This could mislead bundle-regression analysis and review decisions, but it does not establish repository modification or broader compromise.

---

Review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 00a0b198-de78-47a4-ada9-e0bcc2b75024

Commits

Reviewing files that changed from the base of the PR and between 13437fb and 77d0e38.

Files selected for processing: 1

• .github/workflows/bundle-analysis.yml

Included review availability: This review used your included allowance. Your plan provides up to 4 included reviews per hour; 1 remain after this review.