@@ -108,30 +108,8 @@ jobs:
           sudo dpkg -i "/tmp/${NFPM_DEB}"
 
       - name: Stage tree for packaging
-        run: |
-          set -eux
-          STAGE=staging/opt/etherpad
-          mkdir -p "${STAGE}"
-
-          # Production footprint = src/ + bin/ + node_modules/ + metadata.
-          cp -a src bin package.json pnpm-workspace.yaml README.md LICENSE \
-                node_modules "${STAGE}/"
-
-          # Make pnpm-workspace.yaml production-only (same trick Dockerfile uses).
-          printf 'packages:\n  - src\n  - bin\n' > "${STAGE}/pnpm-workspace.yaml"
-
-          mkdir -p packaging/etc
-          cp settings.json.template packaging/etc/settings.json.dist
-
-          # Purge test fixtures and dev caches from node_modules to shrink size.
-          find "${STAGE}/node_modules" -type d \
-               \( -name test -o -name tests -o -name '__tests__' \
-                  -o -name example -o -name examples -o -name docs \) \
-               -prune -exec rm -rf {} + 2>/dev/null || true
-          find "${STAGE}/node_modules" -type f \
-               \( -name '*.md' -o -name '*.ts.map' -o -name '*.map' \
-                  -o -name 'CHANGELOG*' -o -name 'HISTORY*' \) \
-               -delete 2>/dev/null || true
+        # Production deps only; see packaging/stage.sh.
+        run: packaging/stage.sh
 
       - name: Build .deb
         env:
@@ -141,6 +119,22 @@ jobs:
           mkdir -p dist
           nfpm package --packager deb -f packaging/nfpm.yaml --target dist/
 
+      - name: Check package size
+        # apt-publish commits the .deb into ether/ether.github.com, and GitHub
+        # rejects files over 100 MiB. Fail here, with some headroom, so a
+        # size regression shows up on the PR instead of at release time.
+        run: |
+          set -euo pipefail
+          LIMIT=$((95 * 1024 * 1024))
+          for f in dist/*.deb; do
+            size=$(stat -c %s "$f")
+            echo "$f: $((size / 1024 / 1024)) MiB ($size bytes)"
+            if [ "$size" -gt "$LIMIT" ]; then
+              echo "::error file=$f::$f is over 95 MiB; GitHub rejects files over 100 MiB in the apt repo"
+              exit 1
+            fi
+          done
+
       - name: Smoke-test the package (amd64 only)
         if: matrix.arch == 'amd64'
         run: |
 
@@ -25,13 +25,8 @@ Prereqs: Node 24 (current LTS; matches `engines.node` floor), pnpm 12+, nfpm.
 pnpm install --frozen-lockfile
 pnpm run build:etherpad
 
-# Stage the tree the way CI does:
-STAGE=staging/opt/etherpad
-mkdir -p "$STAGE"
-cp -a src bin package.json pnpm-workspace.yaml README.md LICENSE \
-      node_modules "$STAGE/"
-printf 'packages:\n  - src\n  - bin\n' > "$STAGE/pnpm-workspace.yaml"
-cp settings.json.template packaging/etc/settings.json.dist
+# Stage the tree the way CI does (production deps only):
+packaging/stage.sh
 
 VERSION=$(node -p "require('./package.json').version") \
 ARCH=amd64 \
 
@@ -0,0 +1,55 @@
+#!/usr/bin/env bash
+# Stage the production tree for nfpm under staging/opt/etherpad.
+# Run from the repo root after `pnpm install` and `pnpm run build:etherpad`.
+# Used by .github/workflows/deb-package.yml and packaging/test-local.sh.
+set -euxo pipefail
+
+cd "$(dirname "$0")/.."
+
+STAGE=staging/opt/etherpad
+rm -rf staging
+mkdir -p "${STAGE}"
+
+# Production footprint = src/ + bin/ + metadata, plus a fresh
+# production-only node_modules installed below. src/ already holds the
+# admin + oidc builds from `build:etherpad`. Copying the workspace
+# node_modules used to ship every devDependency (typescript, playwright,
+# vitest, eslint, vite, ...) and the admin/ui/doc dependency trees, which
+# pushed the .deb past GitHub's 100 MiB per-file limit for the apt repo.
+cp -a src bin package.json pnpm-lock.yaml README.md LICENSE "${STAGE}/"
+rm -rf "${STAGE}/src/node_modules" "${STAGE}/bin/node_modules" \
+       "${STAGE}/src/tests" "${STAGE}/src/playwright.config.ts" \
+       "${STAGE}/src/vitest.config.ts"
+
+# Install production deps for the runtime workspace (root, src, bin) from
+# the lockfile. pnpm installs the dependencies of every importer listed in
+# the lockfile, even if its directory is missing, so drop the build-only
+# importers from the staged lockfile and workspace file. Everything else
+# (overrides, build policy) stays as-is so --frozen-lockfile still matches.
+BUILD_ONLY='admin|doc|ui|admin/tools/openapi-codegen'
+awk -v re="^  (${BUILD_ONLY}):\$" '
+  /^importers:/ { imp = 1; print; next }
+  imp && /^[^ ]/ { imp = 0; skip = 0 }
+  imp && /^  [^ ]/ { skip = ($0 ~ re) }
+  !skip { print }
+' pnpm-lock.yaml > "${STAGE}/pnpm-lock.yaml"
+grep -Ev "^  - (${BUILD_ONLY})\$" pnpm-workspace.yaml > "${STAGE}/pnpm-workspace.yaml"
+( cd "${STAGE}" && CI=1 pnpm install --prod --frozen-lockfile )
+
+# Ship the same minimal workspace file as before (same trick the
+# Dockerfile uses) and no lockfile.
+printf 'packages:\n  - src\n  - bin\n' > "${STAGE}/pnpm-workspace.yaml"
+rm -f "${STAGE}/pnpm-lock.yaml"
+
+mkdir -p packaging/etc
+cp settings.json.template packaging/etc/settings.json.dist
+
+# Purge test fixtures and docs from node_modules to shrink size.
+find "${STAGE}/node_modules" -type d \
+     \( -name test -o -name tests -o -name '__tests__' \
+        -o -name example -o -name examples -o -name docs \) \
+     -prune -exec rm -rf {} + 2>/dev/null || true
+find "${STAGE}/node_modules" -type f \
+     \( -name '*.md' -o -name '*.ts.map' -o -name '*.map' \
+        -o -name 'CHANGELOG*' -o -name 'HISTORY*' \) \
+     -delete 2>/dev/null || true
@@ -36,11 +36,8 @@ CI=1 pnpm install --frozen-lockfile
 
 echo "==> Building staging tree"
 rm -rf staging dist packaging/etc
-mkdir -p staging/opt/etherpad packaging/etc dist
-cp -a src bin package.json pnpm-workspace.yaml README.md LICENSE node_modules \
-      staging/opt/etherpad/
-printf 'packages:\n  - src\n  - bin\n' > staging/opt/etherpad/pnpm-workspace.yaml
-cp settings.json.template packaging/etc/settings.json.dist
+mkdir -p dist
+packaging/stage.sh
 
 echo "==> Building .deb via nfpm ${NFPM_VERSION} (in container)"
 VERSION="$(node -p 'require("./package.json").version')"