Location:.gitea/workflows/ci.yml — "Report bundle sizes" step (continue-on-error: true, writes a table to the step summary and nothing else)
Problem
The size table is useful but purely informational. A dependency that accidentally pulls a second copy of matrix-js-sdk, or a KaTeX/pdf.js chunk that stops being lazy-loaded, would add megabytes to first paint with no signal. Nobody reads the step summary on every push.
Suggested fix
Add a small size-limit check (e.g. size-limit with the file preset, or a 20-line script over dist/assets) with budgets for the entry chunk and total gzip; fail on pull requests when the budget is exceeded by more than ~5%, warn on push. Record the current numbers as the initial budget so it starts green.
Filed from the September 2026 client audit (CI pipeline review, branch lotus @ 4bea4895).
**Location:** `.gitea/workflows/ci.yml` — "Report bundle sizes" step (`continue-on-error: true`, writes a table to the step summary and nothing else)
### Problem
The size table is useful but purely informational. A dependency that accidentally pulls a second copy of matrix-js-sdk, or a KaTeX/pdf.js chunk that stops being lazy-loaded, would add megabytes to first paint with no signal. Nobody reads the step summary on every push.
### Suggested fix
Add a small size-limit check (e.g. `size-limit` with the `file` preset, or a 20-line script over `dist/assets`) with budgets for the entry chunk and total gzip; fail on pull requests when the budget is exceeded by more than ~5%, warn on push. Record the current numbers as the initial budget so it starts green.
---
_Filed from the September 2026 client audit (CI pipeline review, branch `lotus` @ 4bea4895)._
jared
added this to the Audit 2026-09 · Medium & Low milestone 2026-09-12 01:57:45 -04:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Location:
.gitea/workflows/ci.yml— "Report bundle sizes" step (continue-on-error: true, writes a table to the step summary and nothing else)Problem
The size table is useful but purely informational. A dependency that accidentally pulls a second copy of matrix-js-sdk, or a KaTeX/pdf.js chunk that stops being lazy-loaded, would add megabytes to first paint with no signal. Nobody reads the step summary on every push.
Suggested fix
Add a small size-limit check (e.g.
size-limitwith thefilepreset, or a 20-line script overdist/assets) with budgets for the entry chunk and total gzip; fail on pull requests when the budget is exceeded by more than ~5%, warn on push. Record the current numbers as the initial budget so it starts green.Filed from the September 2026 client audit (CI pipeline review, branch
lotus@4bea4895).