ci: track package bundle size with build report and PR comparison

.github/scripts/upsert-bundle-size-comment.cjs

@@ -0,0 +1,42 @@
+/**
+ * Upserts a sticky PR comment with the bundle-size report.
+ *
+ * Invoked via `actions/github-script`. The comment body is generated by
+ * `tools/bundle-size.ts --compare --markdown <file>` and its path is passed in
+ * via the COMMENT_PATH environment variable. The body already carries the
+ * marker below as its first line, which we reuse to find the existing comment.
+ */
+
+const fs = require("node:fs");
+
+const MARKER = "<!-- bundle-size-report -->";
+
+module.exports = async ({ github, context }) => {
+  const { owner, repo } = context.repo;
+  const issue_number = context.issue.number;
+  const body = fs.readFileSync(process.env.COMMENT_PATH, "utf-8");
+
+  const comments = await github.paginate(github.rest.issues.listComments, {
+    owner,
+    repo,
+    issue_number,
+    per_page: 100,
+  });
+  const existing = comments.find((c) => c.body?.includes(MARKER));
+
+  if (existing) {
+    await github.rest.issues.updateComment({
+      owner,
+      repo,
+      comment_id: existing.id,
+      body,
+    });
+  } else {
+    await github.rest.issues.createComment({
+      owner,
+      repo,
+      issue_number,
+      body,
+    });
+  }
+};

.github/workflows/bundle-size.yml

@@ -0,0 +1,113 @@
+name: Bundle Size
+
+# On PRs: build the packages, diff their sizes against the committed baseline
+# (bundle-size-baseline.json), post a sticky comment, and fail the check only
+# when a package's packed tarball grows past the budget in tools/bundle-size.ts.
+# On push to main: regenerate and commit the baseline so future PRs diff against
+# the latest main.
+on:
+  pull_request:
+    branches: [main]
+    paths:
+      - 'packages/appkit/**'
+      - 'packages/appkit-ui/**'
+      - 'packages/shared/**'
+      - 'bundle-size-baseline.json'
+      - 'tools/bundle-size.ts'
+      - '.github/workflows/bundle-size.yml'
+  push:
+    branches: [main]
+    paths:
+      - 'packages/appkit/**'
+      - 'packages/appkit-ui/**'
+      - 'packages/shared/**'
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  report:
+    name: Report bundle size
+    if: github.event_name == 'pull_request'
+    permissions:
+      contents: read
+      pull-requests: write
+      id-token: write # setup-jfrog-npm exchanges an OIDC token for registry auth
+    runs-on:
+      group: databricks-protected-runner-group
+      labels: linux-ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - name: Setup JFrog npm
+        uses: ./.github/actions/setup-jfrog-npm
+      - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version: 24
+          cache: 'pnpm'
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+      - name: Build packages
+        run: pnpm build
+      - name: Compare bundle size against baseline
+        id: size
+        run: pnpm exec tsx tools/bundle-size.ts --compare --markdown bundle-size-comment.md
+
+      # Fork PRs get a read-only GITHUB_TOKEN, so commenting would 403 and the
+      # gate would surface a failure the author can't act on. Skip both for
+      # forks — the sizes are still printed in the job log above.
+      - name: Upsert bundle-size comment
+        if: github.event.pull_request.head.repo.full_name == github.repository
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+        env:
+          COMMENT_PATH: bundle-size-comment.md
+        with:
+          script: |
+            const upsert = require('./.github/scripts/upsert-bundle-size-comment.cjs');
+            await upsert({ github, context });
+
+      - name: Fail if over budget
+        if: steps.size.outputs.exceeded == 'true' && github.event.pull_request.head.repo.full_name == github.repository
+        run: |
+          echo "::error::A package's packed tarball grew past the bundle-size budget. See the PR comment for details. Reduce the size, or acknowledge the increase by updating bundle-size-baseline.json."
+          exit 1
+
+  baseline:
+    name: Update baseline
+    if: github.event_name == 'push'
+    permissions:
+      contents: write
+      id-token: write # setup-jfrog-npm exchanges an OIDC token for registry auth
+    runs-on:
+      group: databricks-protected-runner-group
+      labels: linux-ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - name: Setup JFrog npm
+        uses: ./.github/actions/setup-jfrog-npm
+      - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version: 24
+          cache: 'pnpm'
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+      - name: Build packages
+        run: pnpm build
+      - name: Regenerate baseline
+        run: pnpm exec tsx tools/bundle-size.ts --baseline
+      - name: Commit baseline if changed
+        run: |
+          if git diff --quiet bundle-size-baseline.json; then
+            echo "Baseline unchanged."
+            exit 0
+          fi
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git add bundle-size-baseline.json
+          git commit -s -m "chore: update bundle-size baseline [skip ci]"
+          git push