fix(deps): keep the end-to-end test framework out of the runtime image #179

Sammanfogat

supernaut sammanfogade 1 incheckning från fix/e2e-deps-out-of-runtime in i main

2026-08-02 16:14:18 +00:00

supernaut kommenterad

2026-08-02 16:10:16 +00:00

Ägare

Closes #178.

nightwatch was declared in dependencies rather than devDependencies, and the Containerfile
installs production dependencies only — pnpm install --prod at both stages. So a WebDriver client
and its whole closure was installed into the image serving the public site: selenium-webdriver
(~18 MB), nightwatch (~3.3 MB), axe-core (~2.9 MB) and their transitive dependencies.

Nothing under src/ imports it. It is used by nightwatch.conf.js and scripts/e2e.mjs, both of
which run only on a developer machine via the pre-push hook.

Beyond the size, a browser-automation client with no runtime purpose is avoidable attack surface in
a public-facing container.

Verified, not assumed

Lockfile importer section, before and after:

main    runtime-deps: True    dev-deps: False
branch  runtime-deps: False   dev-deps: True

A real pnpm install --prod --frozen-lockfile tree on this branch:

nightwatch           absent
selenium-webdriver   absent
axe-core             absent
geckodriver          absent

geckodriver was already correctly placed; only nightwatch was wrong.

The end-to-end suite still runs — 3 assertions passing — and pnpm lint, pnpm check (0 errors)
and pnpm test (206 passing) are clean.

Why this is separate from the framework question

The same misplacement would ship whichever end-to-end framework is used, so this is worth correcting
on its own rather than folded into #174. It is also the smallest possible change: one entry moved,
lockfile refreshed, no behaviour touched.

Closes #178. `nightwatch` was declared in `dependencies` rather than `devDependencies`, and the Containerfile installs production dependencies only — `pnpm install --prod` at both stages. So a WebDriver client and its whole closure was installed into the image serving the public site: `selenium-webdriver` (~18 MB), `nightwatch` (~3.3 MB), `axe-core` (~2.9 MB) and their transitive dependencies. Nothing under `src/` imports it. It is used by `nightwatch.conf.js` and `scripts/e2e.mjs`, both of which run only on a developer machine via the `pre-push` hook. Beyond the size, a browser-automation client with no runtime purpose is avoidable attack surface in a public-facing container. ### Verified, not assumed Lockfile importer section, before and after: ``` main runtime-deps: True dev-deps: False branch runtime-deps: False dev-deps: True ``` A real `pnpm install --prod --frozen-lockfile` tree on this branch: ``` nightwatch absent selenium-webdriver absent axe-core absent geckodriver absent ``` `geckodriver` was already correctly placed; only `nightwatch` was wrong. The end-to-end suite still runs — 3 assertions passing — and `pnpm lint`, `pnpm check` (0 errors) and `pnpm test` (206 passing) are clean. ### Why this is separate from the framework question The same misplacement would ship whichever end-to-end framework is used, so this is worth correcting on its own rather than folded into #174. It is also the smallest possible change: one entry moved, lockfile refreshed, no behaviour touched.

supernaut lade till 1 incheckning

2026-08-02 16:10:16 +00:00

fix(deps): keep the end-to-end test framework out of the runtime image

ci / ci (pull_request) Successful in 1m20s

Detaljer

b0b891db7e

nightwatch sat in dependencies, and the Containerfile installs production
dependencies only, so a WebDriver client and its closure — selenium-webdriver,
nightwatch, axe-core and their transitive deps, roughly 24 MB — were installed
into the image serving the public site. Nothing in src/ imports it; it is used
by nightwatch.conf.js and scripts/e2e.mjs, which run only on a developer
machine via the pre-push hook.

Beyond the size, a browser-automation client with no runtime purpose is
avoidable attack surface in a public-facing container.

Verified: a --prod install tree now contains none of nightwatch,
selenium-webdriver, axe-core or geckodriver, and the end-to-end suite still
passes.

Closes #178

supernaut sammanfogade incheckning 40c6188ac3 till main

2026-08-02 16:14:18 +00:00

supernaut tog bort grenen fix/e2e-deps-out-of-runtime

2026-08-02 16:14:18 +00:00

supernaut refererade denna ändringsförfrågan från en incheckning

2026-08-02 16:14:19 +00:00

fix(deps): keep the end-to-end test framework out of the runtime image (#179)

supernaut refererade denna ändringsförfrågan från en incheckning

2026-08-03 09:41:50 +00:00

fix(deps): keep the end-to-end test framework out of the runtime image (#179)

Logga in för att delta i denna konversation.

Inga granskare