Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions .bundlemonrc.json
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,7 @@
},
{
"path": "./libraries/browser-tracker-core/dist/index.module.js",
"maxSize": "25kb",
"maxSize": "26kb",
"maxPercentIncrease": 10
},
{
Expand All @@ -31,5 +31,5 @@
"maxPercentIncrease": 10
}
],
"reportOutput": ["github"]
"reportOutput": []
}
14 changes: 11 additions & 3 deletions .github/workflows/change_check.yml
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,11 @@ jobs:
check:
runs-on: ubuntu-latest

permissions:
contents: read
pull-requests: write
checks: write

env:
BROWSERSLIST_IGNORE_OLD_DATA: true

Expand Down Expand Up @@ -55,7 +60,10 @@ jobs:
run: api-extractor run

- name: Check bundle size using bundlemon
run: npx bundlemon@1.4.0
if: github.event.pull_request.head.repo.full_name == github.repository
run: npx bundlemon@3
Copy link

Copilot AI Apr 20, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Using npx bundlemon@3 leaves the workflow non-deterministic because it will pick up whatever the latest 3.x release is at runtime. To make CI reproducible and avoid unexpected breakages, pin to an exact version (or at least a minor/patch range you control).

Suggested change
run: npx bundlemon@3
run: npx bundlemon@3.0.0

Copilot uses AI. Check for mistakes.
env:
BUNDLEMON_PROJECT_ID: 630fceda4ed824a9d3733ec0
CI_COMMIT_SHA: ${{github.event.pull_request.head.sha || github.sha}}
BUNDLEMON_PROJECT_ID: 69e5e44cf67d5035af9fd1c0
BUNDLEMON_PROJECT_APIKEY: ${{ secrets.BUNDLEMON_PROJECT_APIKEY }}
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
CI_COMMIT_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
Comment on lines +66 to +69
Copy link

Copilot AI Apr 20, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This job runs on the pull_request event, but secrets.BUNDLEMON_PROJECT_APIKEY is not provided to workflows triggered from forked PRs. If bundlemon requires the API key, this step will fail for external contributors. Consider guarding the step with an if: that checks the PR is from the same repo (or that the secret is non-empty), or switching to a safer alternative pattern for forks.

Copilot uses AI. Check for mistakes.
Loading