UI5 / cli / 32716439411

94%

push

github

ci: Prevent internal packages from declaring production dependencies

Add a CI check that fails if any "internal/*" workspace package declares a
production "dependencies" entry. All dependencies of these packages must be
declared as "devDependencies".

Dependabot derives the commit-message type from whether an update targets
"dependencies" or "devDependencies" ("deps" vs. "build(deps-dev)") and does
not treat our internal, unpublished packages differently. A production
dependency there therefore produces a misleading "deps" commit.

Migrate the existing production dependencies of the benchmark, documentation,
e2e-tests and shrinkwrap-extractor internal packages to devDependencies, which
is safe as these packages are private and never published.

Consolidate this check and the existing "engines" consistency check into a
single reusable scripts/check-workspaces.js (run via "npm run check-workspaces"),
replacing the two inline Node heredocs in github-ci.yml with one step.

Document the rule for contributors and agents in AGENTS.md.

7288 of 8035 branches covered (90.7%)

Branch coverage included in aggregate %.

13964 of 14565 relevant lines covered (95.87%)

5259.79 hits per line