[setchy]

Summary

The packaged app hand-included node_modules/**/*, overriding electron-builder's production dependency collector. It also declared four renderer-only packages (cn, react, react-dom, react-router-dom) as runtime dependencies even though Vite bundles them.

This lets electron-builder collect the runtime closure and classifies dependencies by whether they are loaded from disk at runtime.

• Remove the node_modules/**/* glob from electron-builder.js.
• Move cn, react, react-dom, and react-router-dom to devDependencies.
• Keep electron-log, electron-menubar, and electron-updater external and in dependencies; do not bundle them.
• Add scripts/verifyPackagedDependencies.js and run it in the build and publish matrices.
• Replace the vite.config.mts TODO with the documented decision.
• Document the rule in CONTRIBUTING.md.

Measured on macOS: packaged node_modules went from 17.2 MB / 26 packages to 2.3 MB / 18 packages.

Test plan

• pnpm install --frozen-lockfile
• pnpm check
• pnpm test — 204 files, 1,974 tests
• pnpm build
• node scripts/verifyPackagedDependencies.js dist/mac-arm64/Gitify.app — PASS, 18 packages / 2.3 MB
• Packaged macOS app launched; renderer loaded notifications, log written, updater ran, no MODULE_NOT_FOUND
• Windows, Linux, and macOS CI packaging + verification — all passed

Draft for review. The --dir build lacks app-update.yml, so its update check logs the expected ENOENT; a full packaged build provides the file.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud