ci(design-system): gate published bundle singleton externals

.github/workflows/tests.yml

@@ -107,3 +107,9 @@ jobs:
 
       - name: unit tests
         run: yarn test:unit
+
+      - name: Check declared imports
+        run: yarn workspace @strapi/design-system check:declared-imports
+
+      - name: Verify published bundle contract
+        run: yarn workspace @strapi/design-system test:bundle-contract

packages/design-system/bundle-contract.config.json

@@ -0,0 +1,11 @@
+{
+  "mustBeExternal": [
+    "@codemirror/lang-json",
+    "@codemirror/state",
+    "@codemirror/view",
+    "@tanstack/react-virtual",
+    "@uiw/react-codemirror"
+  ],
+  "mustNotContain": ["Unrecognized extension value in extension set"],
+  "distFiles": ["dist/index.mjs", "dist/index.js"]
+}

packages/design-system/package.json

@@ -74,6 +74,8 @@
     "format": "oxfmt .",
     "test:ts": "tsc --noEmit",
     "test:unit": "jest -c jest.config.mjs",
+    "test:bundle-contract": "jest -c jest.config.mjs src/__tests__/bundle-contract.test.ts",
+    "check:declared-imports": "node ./scripts/check-declared-imports.mjs",
     "watch": "vite build --watch"
   },
   "gitHead": "c74900b0ee3525510d266dc83c9743cb24dafced"

packages/design-system/scripts/check-declared-imports.mjs

@@ -0,0 +1,65 @@
+import { readFileSync, readdirSync } from 'node:fs';
+import { join, relative } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const packageRoot = join(fileURLToPath(new URL('.', import.meta.url)), '..');
+const srcRoot = join(packageRoot, 'src');
+
+const pkg = JSON.parse(readFileSync(join(packageRoot, 'package.json'), 'utf8'));
+const declared = new Set([
+  ...Object.keys(pkg.dependencies ?? {}),
+  ...Object.keys(pkg.peerDependencies ?? {}),
+]);
+
+/** Resolved via workspace / bundler without a package.json entry. */
+const IGNORE = new Set(['@test/utils']);
+
+const IMPORT_RE = /(?:import|export)[^'"]*from ['"]([^'"]+)['"]|import\(['"]([^'"]+)['"]\)/g;
+
+const walk = (dir, acc = []) => {
+  for (const entry of readdirSync(dir, { withFileTypes: true })) {
+    const path = join(dir, entry.name);
+    if (entry.isDirectory()) {
+      if (entry.name === 'node_modules' || entry.name === 'dist' || entry.name === '__tests__') {
+        continue;
+      }
+      walk(path, acc);
+    } else if (/\.(tsx?)$/.test(entry.name)) {
+      acc.push(path);
+    }
+  }
+
+  return acc;
+};
+
+const rootPackage = (mod) =>
+  mod.startsWith('@') ? mod.split('/').slice(0, 2).join('/') : mod.split('/')[0];
+
+const missing = [];
+
+for (const file of walk(srcRoot)) {
+  const source = readFileSync(file, 'utf8');
+  let match;
+
+  while ((match = IMPORT_RE.exec(source))) {
+    const mod = match[1] ?? match[2];
+    if (!mod || mod.startsWith('.') || mod.startsWith('/')) continue;
+
+    const pkgName = rootPackage(mod);
+    if (IGNORE.has(pkgName) || IGNORE.has(mod)) continue;
+    if (pkgName.startsWith('@strapi/')) continue;
+    if (declared.has(pkgName) || declared.has(mod)) continue;
+
+    missing.push({ file: relative(packageRoot, file), mod });
+  }
+}
+
+if (missing.length > 0) {
+  console.error('Undeclared production imports (add to package.json dependencies):');
+  for (const { file, mod } of missing) {
+    console.error(`  ${file}: "${mod}"`);
+  }
+  process.exit(1);
+}
+
+console.log('All production imports are declared in package.json');

packages/design-system/src/__tests__/bundle-contract.test.ts

@@ -0,0 +1,29 @@
+import { readFileSync } from 'node:fs';
+import { resolve } from 'node:path';
+
+import contract from '../../bundle-contract.config.json';
+
+const externalImportPattern = (pkg: string) =>
+  new RegExp(`(?:from|require\\()\\s*["']${pkg.replace('/', '\\/')}["']`);
+
+/**
+ * Regression guard for design-system #2032 / strapi/strapi #26951.
+ *
+ * Singleton deps used across package boundaries must stay external in the
+ * published bundle. Inlined copies break instanceof checks in production admin.
+ */
+describe('published bundle contract', () => {
+  const packageRoot = resolve(__dirname, '../..');
+
+  describe.each(contract.distFiles)('%s', (relPath) => {
+    const content = readFileSync(resolve(packageRoot, relPath), 'utf-8');
+
+    it.each(contract.mustNotContain)('does not inline forbidden marker: %s', (marker) => {
+      expect(content).not.toContain(marker);
+    });
+
+    it.each(contract.mustBeExternal)('imports %s externally', (pkg) => {
+      expect(content).toMatch(externalImportPattern(pkg));
+    });
+  });
+});