[JohnMcLear]

The v3.3.14 apt-publish job failed because GitHub rejected etherpad_3.3.14-1_amd64.deb (101 MiB) for being over its 100 MiB file limit. The staging step copied the whole workspace node_modules into the package, so every devDependency went in with it.

The staging step now lives in packaging/stage.sh and does a fresh pnpm install --prod --frozen-lockfile for root, src and bin. pnpm installs deps for every importer in the lockfile, even when its directory is missing, so the script removes the admin/doc/ui/openapi-codegen importers from the staged lockfile first. Overrides and build policy are unchanged, so the frozen install still matches.

Size (amd64, built locally from develop):

• before: 101.0 MiB (.deb), 555 MB unpacked
• after: 45.9 MiB (.deb), about 240 MB unpacked

Dropped: devDependencies (typescript 6/7, playwright, vitest, eslint, vite/rolldown, vitepress, jsdom for tests, @types/*), the admin/ui/doc dependency trees (react, radix, tanstack, solid, ...), plus src/tests, src/playwright.config.ts and src/vitest.config.ts. The built admin UI in src/templates/admin is still shipped. The shipped pnpm-workspace.yaml is the same as before, and no lockfile is shipped, also as before.

I also added a "Check package size" step that fails the build if any .deb is over 95 MiB.

Tested locally: I extracted the new .deb and booted it through /usr/bin/etherpad with sqlite. /health, /, a pad page and its bundled JS/CSS, /admin/ and its assets, the API (createPad/getText), and txt/html/pdf/docx export all returned 200. bin/plugins.ts i ep_align installed into src/plugin_packages, and after a restart the plugin loaded and showed up in the pad bundle. The dpkg/systemd/postinst/plugin_packages smoke test runs in this workflow.

After merge, publishing to the apt repo needs a new tag (3.3.15). The release and apt-publish jobs only run when github.ref is a v* tag. A workflow_dispatch from develop skips them, and re-running or dispatching on v3.3.14 uses the old workflow from that tag.

🤖 Generated with Claude Code

https://claude.ai/code/session_01TcYAoEw35xr1qP19ipr25W

[qodo-code-review]

ⓘ Qodo reviews are paused because the subscription is no longer active. Ask your workspace admin to reactivate the subscription to resume reviews. Manage billing

[qodo-free-for-open-source-projects]

PR Summary by Qodo

Keep Debian packages below GitHub’s file-size limit

🐞 Bug fix ⚙️ Configuration changes 🕐 20-40 Minutes

AI Description

• Stage production dependencies instead of copying the development workspace into Debian packages.
• Exclude build-only workspaces and test files while retaining built application assets.
• Fail package builds above 95 MiB before release publishing.

Diagram

graph TD
  CI["Debian workflow"] --> Build["Asset build"] --> Stage["Staging script"] --> Filter["Importer filter"] --> Install["Production install"] --> NFPM["nfpm package"] --> Gate["Size gate"] --> Publish["Apt publishing"]

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Use pnpm deploy for the runtime workspace

• ➕ Could replace manual staging and lockfile filtering with a package-manager operation.
• ➖ Would need validation against the existing workspace links, built assets, plugin layout, and nfpm tree.

Recommendation: Keep the shared staging script for this fix: it preserves the existing package layout while removing the dependencies responsible for the size failure. Consider pnpm deploy separately if it can reproduce that layout and pass the package smoke tests.

Files changed (4) +77 / -36

Bug fix (2) +73 / -24

deb-package.ymlUse production staging and enforce a Debian package size limit +18/-24

Use production staging and enforce a Debian package size limit

• Replaces inline workspace copying with packaging/stage.sh. Checks each built .deb against a 95 MiB limit before the existing smoke test and release path.

.github/workflows/deb-package.yml

stage.shStage a runtime-only dependency tree for nfpm +55/-0

Stage a runtime-only dependency tree for nfpm

• Copies runtime sources and metadata, removes test files, and filters build-only importers before a frozen production install. Retains the previously shipped minimal workspace file and excludes the temporary lockfile from the package.

packaging/stage.sh

Documentation (1) +2 / -7

README.mdDocument the shared production staging command +2/-7

Document the shared production staging command

• Updates local build instructions to use packaging/stage.sh instead of manually copying the full workspace.

packaging/README.md

Other (1) +2 / -5

test-local.shShare CI’s staging path with local package tests +2/-5

Share CI’s staging path with local package tests

• Calls packaging/stage.sh in place of the local full-workspace copy so local Debian builds exercise the same staging process as CI.

packaging/test-local.sh

[qodo-free-for-open-source-projects]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

Tip of the day

💡 Did you know, you can commit Qodo's fix in one click with committable suggestions (GitHub & GitLab)

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗