Repository navigation
fix: Shrink the consumer plugin bundle and upload its source maps - #481
Open
kevwilliams wants to merge 6 commits into
Open
kevwilliams wants to merge 6 commits into
kevwilliams wants to merge 6 commits into
Conversation
The plugin bundled its own copy of every library it shares with the portal (react-router, react-query and the curated datum-ui subset). The host's copy always wins, yet the browser fetched and parsed each fallback on every load: about 300KB gzipped, 516KB of it unminified react-router source, for the project home column alone. Production builds now mark the host-provided modules import: false. Dev builds keep the fallbacks so the standalone preview runs without a host. react/jsx-runtime gets an explicit entry that keeps its fallback. Left implicit it inherits import: false from react, but the portal does not share that subpath, so the plugin would throw "must be provided by host" on load. Co-Authored-By: Claude <claude@anthropic.com>
minify: false kept the built bundle readable, but every page load paid for it: the project home column shipped 576KB of unminified JavaScript (119KB gzipped). Minified it is 237KB (74KB gzipped), which cuts both transfer and parse time. Readable stack traces come back through source maps uploaded to Sentry in the next commit. Co-Authored-By: Claude <claude@anthropic.com>
The plugin runs inside cloud-portal, so its errors reach the portal's Sentry project with minified frames. Builds now emit hidden source maps and upload them to the cloud-portal project. Frames resolve through debug IDs injected into each chunk, not a release: the release on those events names the portal's build, not this plugin's. Release creation and finalizing are off for the same reason. The token comes from publish-docker's SENTRY_AUTH_TOKEN build arg and is only visible to the build stage. Builds without it (local, forks) skip the upload. The Dockerfile deletes the maps after the build, since serve.ts serves every file in dist/ and the portal's asset proxy would otherwise expose them. Co-Authored-By: Claude <claude@anthropic.com>
ecv
reviewed
Oct 14, 2026
| RUN bun run build | ||
| # Forwarded by publish-docker; the build uploads source maps to Sentry when set. | ||
| # Only this stage sees it: the final image copies dist/ alone. | ||
| ARG SENTRY_AUTH_TOKEN |
Contributor
Author
There was a problem hiding this comment.
Good catch, build-args end up in the exported cache (mode=max). Switched to a BuildKit secret mount via publish-docker's build-secrets, and dropped secrets: inherit on that job so the token isn't also forwarded as a build-arg. 6e629ee
A build-arg is recorded in the history of the stage that uses it, and publish-docker exports every stage to the Actions cache (mode=max), so the token would have been readable by anyone who can restore that cache. The build now reads the token from a secret mount, which never lands in a layer, history or cache. The consumer image job passes it through publish-docker's build-secrets instead of secrets: inherit, which would also have forwarded it as the SENTRY_AUTH_TOKEN build-arg. Co-Authored-By: Claude <claude@anthropic.com>
mattdjenkinson
approved these changes
Oct 15, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The project home page in cloud-portal waits on this plugin's Workloads column, and the column was costing far more than its size suggests. The plugin bundled its own copy of every library it shares with the portal (react-router, react-query, the curated datum-ui subset). The host's copy always wins at runtime, but the browser still downloaded and parsed each copy on every load. Together with
minify: false, the home column shipped 1.7MB of JavaScript (403KB gzipped) across 23 requests. A Firefox capture of cloud.datum.net showed about 900ms fromremoteEntry.jsto the workloads API call.This PR has four commits:
import: false. Dev builds keep the fallbacks so the standalone preview still works.react/jsx-runtimekeeps its own copy, because the portal doesn't share that subpath and the plugin would otherwise throw "must be provided by host" on load.cloud-portalproject, since that's where plugin errors are reported, and are matched by debug IDs rather than release. The Dockerfile deletes the maps from the image, becauseserve.tsserves every file indist/.publish-docker'sbuild-secretsinput and a secret mount, not a build arg. A build arg would be recorded in the build stage's history, whichpublish-dockerexports to the Actions cache (mode=max). The consumer image job no longer usessecrets: inherit, which would also have forwarded the token as a build arg.Every module now marked
import: falseis already provided by cloud-portal'sfederation-host.ts(react, react-dom, react-dom/client, react-router, @tanstack/react-query and the datum-ui subpaths). This can ship without a portal change.Test plan
federation-host.ts: the home column renders identically, all five exposed modules resolve, and there are no errors or React "Invalid hook call" warningsSENTRY_AUTH_TOKENskips Sentry entirelybun run typecheckpassespublish.yamlparsesNotes for reviewers
secrets.SENTRY_AUTH_TOKENas a BuildKit build secret. I couldn't check whether the org-level secret is shared with this repo. If it isn't, the secret is empty and the upload skips silently.minify: falsecomment was protecting. The uploaded source maps are the replacement.