refactor: freeze dependencies for plugins and move it to build time

.gitattributes

@@ -1,3 +1,4 @@
 * text=auto eol=lf
 
 dist/** -diff linguist-generated=true
+dist/node_modules/** binary

.github/workflows/check-dist.yml

@@ -43,9 +43,9 @@ jobs:
             ls -la ./
             exit 1
           fi
-          if [ "$(git diff --ignore-space-at-eol --text dist/ | wc -l)" -gt "0" ]; then
+          if [ "$(git diff --ignore-space-at-eol --text dist/ ':!dist/node_modules/.package-lock.json' | wc -l)" -gt "0" ]; then
             echo "Detected uncommitted changes after build. See status below:"
-            git diff --ignore-space-at-eol --text dist/
+            git diff --ignore-space-at-eol --text dist/ ':!dist/node_modules/.package-lock.json'
             exit 1
           fi
 

README.md

@@ -31,6 +31,26 @@ help in improving gitStream!
 To add support for `.cm` files in your code editor, see our
 [FAQ](https://docs.gitstream.cm/faq/#is-there-cm-syntax-highlighting).
 
+## Managing Dependencies
+
+### Action dependencies (`package.json` → `dependencies`)
+
+Imported by the action's source code. Must be listed in `package.json` for build time.
+
+To add:
+
+1. `npm install <package>` and import it in `src/`
+2. If it can't be bundled by ncc (WASM, native addons), add `--external <package>` to the `package` script and add it to `vendor-plugins` as well
+
+### Plugin dependencies (`vendor-plugins` script in `package.json`)
+
+Packages that user plugins can `require()` at runtime. Installed into `dist/node_modules/` at build time and committed to the repo.
+
+To add:
+
+1. Add with a pinned version to the `vendor-plugins` script in `package.json`
+2. Run `npm run package` and commit the updated `dist/node_modules/`
+
 ## License
 
 The gitStream GitHub Action is licensed under the Apache License. See

action.yml

@@ -117,19 +117,11 @@ runs:
       shell: bash
       run: mv gitstream code
 
-    - name: Clear npm cache
-      shell: bash
-      run: npm cache clean --force
-
-    - name: Install Dependencies for plugins
-      shell: bash
-      continue-on-error: true
-      run: npm i --ignore-scripts moment@2.30.1 lodash@4.18.1 axios@1.14.0 @octokit/rest@20.1.1
-
     - name: Run RulesEngine
       shell: bash
       run: node ${{ github.action_path }}/dist/index.js
       env:
+        NODE_PATH: ${{ github.action_path }}/dist/node_modules
         HEAD_REF: ${{ steps.safe-strings.outputs.head_ref }}
         BASE_REF: ${{ steps.safe-strings.outputs.base_ref }}
         CLIENT_PAYLOAD: ${{ steps.safe-strings.outputs.client_payload }}