DPUse Development

Introduction

Actions for managing DPUse projects.

Installation

[!WARNING] This project is currently published to npm, but is not designed for general use. It is custom built for the DPUse CI/CD process. You are welcome to clone and customise it for your own purposes, but you will need to adapt it to your own project structure and tooling.

DPUse Projects

Entry/top level projects...

| Name | Description | | ------ | ------------------------------- | | app | Frontend or client application. | | api | Backend API. | | engine | | | shared | |

Plugin project groupings...

| Name | Description | | ---------- | ------------------------------------------------------------------------------------------------------------------------------- | | connectors | Connections... | | contexts | Areas,Models... Dimensions, Entities, Secondary Measures... Hierarchies, Levels... Characteristics, Events, Primary Measures... | | presenters | Presentations... | | cookbooks | Recipes... | | tools | |

Support projects...

| Name | Description | | ----------- | ----------------------------------------- | | development | This package. | | kb | Knowledge content and deployment scripts. | | resources | Sample data and deployment scripts. |

Actions

The package implements the following actions:

| Name | Notes | | --------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | auditDependencies | Audit the project's dependencies for known security vulnerabilities. uses the owasp-dependency-check module to perform the checks. Updates the OWASP badge(s) at the top of this page. Also runs the 'npm outdatedcommand. | | buildDirectoryIndex | Build an index for the specified directory path. | | buildProject | Builds the package using Vite. Output to '/dist' directory. Wrangler for api. Nuxt for app-nuxt. Builds bundle analysis reports. | | checkDependencies | Identifies outdated dependencies using npm outdatedandnpm-check-updateswith option to automatically install latest versions. | | documentDependencies | Identify licenses of the project's production and peer dependencies. Updates the table in the **Dependency Licenses** section of this page and summary files licenses.json and licenseTree.json in th licenses directory of this repository. Also downloads a copy of dependency license tolicenses/downloads'.. | | formatCode | Uses prettier to enforce formatting style rules. | | lintCode | Uses eslint to check the code for potential errors and enforces coding style rules. | | releaseProject | Bump version, builds config, builds project, synchronise with GitHub and publish to npm or Cloudflare. | | syncProjectWithGitHub | Synchronise the local repository with the main GitHub repository. | | testProject | ❌ Not implemented. |

Usage

All utilities are designed to be run from package.json scripts and assume that the project follows the standard DPUse directory structure and that it includes a config.json file in the root directory.

Please see other DPUse repositories for actual usage.

Dependency Licenses

[!WARNING] Dependency licenses are not documented here: @dpuse/dpuse-development is a development-only tool and is never part of a production release

Dependency Tree

[!WARNING] Dependency licenses are not documented here: @dpuse/dpuse-development is a development-only tool and is never part of a production release

Bundle Analysis

The Bundle Analysis Reports provide detailed breakdowns of the bundle's composition and module sizes, helping to identify which modules contribute most to the final build. Two complementary reports are generated automatically on each release:

• rollup-plugin-visualizer — generates a static treemap/sunburst view based on pre-build module estimates, useful for a quick visual scan of overall bundle composition, including CSS assets.
• Sonda — analyses final source maps to capture the effects of tree-shaking and minification, rather than relying on pre-build estimates. This gives a more accurate picture of what's actually shipped, traces module-level dependencies, and shows the size of each module after tree-shaking and minification for more precise insight into what's driving bundle size. Note: Sonda's Vite reports currently exclude CSS files, since Vite does not generate source maps for CSS.

View the rollup-plugin-visualizer Report.

View the Sonda Report.

The Bundle Analysis Report is generated automatically on each release using Sonda, which analyses final source maps to reveal the actual effects of tree-shaking and minification rather than relying on pre-build estimates.

Note: Sonda's Vite reports currently exclude CSS files, since Vite does not generate source maps for CSS.

|Chunk/Module/File|Composition| |:------ |:-----------| | dist/dpuse-development.es.js | 311.6 kB · brotli 63.1 kB | |     acorn → dist/acorn.mjs | ████████░░░░░░░░░░░░ 42.0% | |     acorn-typescript → lib/index.mjs | ███████░░░░░░░░░░░░░ 36.8% | |     src | ██░░░░░░░░░░░░░░░░░░ 10.1% | |         documentDependencies.ts | ░░░░░░░░░░░░░░░░░░░░ 1.8% | |         manageProject.ts | ░░░░░░░░░░░░░░░░░░░░ 1.7% | |         index.ts | ░░░░░░░░░░░░░░░░░░░░ 1.5% | |         documentBundleSizes.ts | ░░░░░░░░░░░░░░░░░░░░ 1.3% | |         checkConfigFiles.ts | ░░░░░░░░░░░░░░░░░░░░ 0.8% | |         documentGovernance.ts | ░░░░░░░░░░░░░░░░░░░░ 0.7% | |         documentOpening.ts | ░░░░░░░░░░░░░░░░░░░░ 0.5% | |         cloudflare.ts | ░░░░░░░░░░░░░░░░░░░░ 0.5% | |         documentActions.ts | ░░░░░░░░░░░░░░░░░░░░ 0.5% | |         documentUsage.ts | ░░░░░░░░░░░░░░░░░░░░ 0.4% | |         checkDependencies.ts | ░░░░░░░░░░░░░░░░░░░░ 0.2% | |         formatCode.ts | ░░░░░░░░░░░░░░░░░░░░ 0.1% | |         auditDependencies.ts | ░░░░░░░░░░░░░░░░░░░░ 0.1% | |         lintCode.ts | ░░░░░░░░░░░░░░░░░░░░ 0.1% | |     (unassigned) → [unassigned] | █░░░░░░░░░░░░░░░░░░░ 7.2% | |     @dpuse/dpuse-shared | █░░░░░░░░░░░░░░░░░░░ 3.8% | |         dist/componentConfig.schema-CqVgZGPq.js | █░░░░░░░░░░░░░░░░░░░ 2.9% | |         dist/dpuse-shared-componentModuleConnector.es.js | ░░░░░░░░░░░░░░░░░░░░ 0.8% | |         dist/dpuse-shared-componentModulePresenter.es.js | ░░░░░░░░░░░░░░░░░░░░ 0.1% | |         dist/moduleConfig.schema-vxTWrD6x.js | ░░░░░░░░░░░░░░░░░░░░ 0.0% | |     valibot → dist/index.mjs | ░░░░░░░░░░░░░░░░░░░░ 0.1% |

(unassigned) = bytes Sonda can't trace to a specific source line (whitespace, stray keywords, bundler-injected region markers) — not actual missing/unknown code.

Security & Quality

CodeQL

CodeQL static analysis runs on every push to main and on a weekly schedule, scanning TypeScript, JavaScript, Rust, and GitHub Actions workflow files for security vulnerabilities and coding errors.

SonarCloud

SonarCloud performs continuous code quality and security analysis on every push, detecting bugs, code smells, and security vulnerabilities in the TypeScript source.

Vulnerability Scanning

Two complementary tools continuously monitor dependencies for known vulnerabilities:

• GitHub Dependabot automatically raises pull requests to update vulnerable dependencies, drawing on the GitHub Advisory Database which combines NVD and npm-specific advisories.
• npm audit runs on every push to main via the CI workflow, failing the build if any high or critical severity vulnerabilities are detected.

Supply Chain Security

Socket.dev monitors all dependencies for supply chain risk — detecting malicious packages, dependency confusion, typosquatting, and suspicious behaviour that may not yet have a CVE.

Reporting Vulnerabilities

Please do not open public GitHub issues for security vulnerabilities. Use GitHub private vulnerability reporting instead. See SECURITY.md for the full disclosure policy, contact details, and expected response times.

OpenSSF 🚧

This project is working towards the OpenSSF Best Practices Passing badge, a self-certification covering security policy, vulnerability reporting, build processes, code quality, and more. The OpenSSF Scorecard provides an independent automated assessment of the project's security practices and is an ongoing area of improvement.

Contributing

This repository is maintained solely by its owner and does not accept external contributions. It is part of a larger closed application suite and is published for informational and cloning purposes only.

If you find a security vulnerability, see Reporting Vulnerabilities. For bugs, inconsistencies, or other feedback, you are welcome to open a GitHub issue — feedback is read, but responses and fixes are at the maintainer's discretion.

License

This project is licensed under the MIT License, permitting free use, modification, and distribution.

MIT © 2026-present Jonathan Terrell