refactor: freeze dependencies for plugins and move it to build time (#515)

* refactor: freeze dependencies for plugins and move it from runtime to build time

* pre-bundle dependencies

* "build: rebuild dist with Node 20.12.2"

* add @wasm-fmt/ruff_fmt@0.14.14 to the vendor-plugins npm install script

* docs: update README to include managing action and plugin dependencies

* fix checks

* fix dist

* chore: update brace-expansion versions in package-lock.json and rebuild dist

* chore: update vendor-plugins script to specify npm registry for dependency installation

* chore: update package-lock.json to reflect changes in dependencies

* chore: update vendor-plugins script to remove registry specification for dependency installation

* ci: exclude .package-lock.json from dist diff check

The auto-generated .package-lock.json format varies based on npm cache
state, making it non-deterministic across environments.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Linearb CI <linearb-ci@gmail.com>
Co-authored-by: Misha Kav <misha.kav@gmail.com>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: 4 people

.gitattributes

@@ -1,3 +1,4 @@
 * text=auto eol=lf
 
 dist/** -diff linguist-generated=true
+dist/node_modules/** binary

.github/workflows/check-dist.yml

@@ -43,9 +43,9 @@ jobs:
             ls -la ./
             exit 1
           fi
-          if [ "$(git diff --ignore-space-at-eol --text dist/ | wc -l)" -gt "0" ]; then
+          if [ "$(git diff --ignore-space-at-eol --text dist/ ':!dist/node_modules/.package-lock.json' | wc -l)" -gt "0" ]; then
             echo "Detected uncommitted changes after build. See status below:"
-            git diff --ignore-space-at-eol --text dist/
+            git diff --ignore-space-at-eol --text dist/ ':!dist/node_modules/.package-lock.json'
             exit 1
           fi
 

README.md

@@ -31,6 +31,26 @@ help in improving gitStream!
 To add support for `.cm` files in your code editor, see our
 [FAQ](https://docs.gitstream.cm/faq/#is-there-cm-syntax-highlighting).
 
+## Managing Dependencies
+
+### Action dependencies (`package.json` → `dependencies`)
+
+Imported by the action's source code. Must be listed in `package.json` for build time.
+
+To add:
+
+1. `npm install <package>` and import it in `src/`
+2. If it can't be bundled by ncc (WASM, native addons), add `--external <package>` to the `package` script and add it to `vendor-plugins` as well
+
+### Plugin dependencies (`vendor-plugins` script in `package.json`)
+
+Packages that user plugins can `require()` at runtime. Installed into `dist/node_modules/` at build time and committed to the repo.
+
+To add:
+
+1. Add with a pinned version to the `vendor-plugins` script in `package.json`
+2. Run `npm run package` and commit the updated `dist/node_modules/`
+
 ## License
 
 The gitStream GitHub Action is licensed under the Apache License. See

action.yml

@@ -117,19 +117,11 @@ runs:
       shell: bash
       run: mv gitstream code
 
-    - name: Clear npm cache
-      shell: bash
-      run: npm cache clean --force
-
-    - name: Install Dependencies for plugins
-      shell: bash
-      continue-on-error: true
-      run: npm i --ignore-scripts moment@2.30.1 lodash@4.18.1 axios@1.14.0 @octokit/rest@20.1.1
-
     - name: Run RulesEngine
       shell: bash
       run: node ${{ github.action_path }}/dist/index.js
       env:
+        NODE_PATH: ${{ github.action_path }}/dist/node_modules
         HEAD_REF: ${{ steps.safe-strings.outputs.head_ref }}
         BASE_REF: ${{ steps.safe-strings.outputs.base_ref }}
         CLIENT_PAYLOAD: ${{ steps.safe-strings.outputs.client_payload }}