ci(design-system): gate published bundle singleton externals

[innerdvations]

Summary

• Adds a config-driven published bundle contract test (bundle-contract.config.json + test:bundle-contract) that asserts singleton deps stay external in dist/index.mjs and dist/index.js.
• Adds check:declared-imports to fail when production source imports a package not listed in package.json dependencies/peers (catches undeclared @codemirror/state, @tanstack/react-virtual, etc.).
• Wires both checks into the existing unit_tests CI job after build.

Why is it needed?

strapi/strapi#26951 showed that inlining @codemirror/state into the published design-system bundle breaks JSON fields in production admin. These gates prevent the same class of regression without relying on manual review.

How to test it?

yarn build --filter=@strapi/design-system
yarn workspace @strapi/design-system check:declared-imports
yarn workspace @strapi/design-system test:bundle-contract

Merge order

Draft — CI is expected to fail on main until the fix lands.

Merge after (or together with) #2034, which declares the missing singleton deps and externalizes them in the bundle. Once #2034 is on main, these checks should pass on every PR.

Related issue(s)/PR(s)

• design-system#2032
• After editing relations, unable to load content items strapi#26951
• fix(design-system): externalize @codemirror/state in JSONInput bundle #2034 (fix PR)

[changeset-bot]

⚠️ No Changeset found

Latest commit: bf993cb

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
design-system	Ready	Preview, Comment	Jul 10, 2026 1:42pm

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 9f1ada9d-663e-4570-bc3b-9bab71a01a84

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud