chore(release): vendor bench from npm at release time

[soroushm]

Closes #6.

vendor/ (bench's sandbox Dockerfile + self-contained dist/harness.mjs) leaves main the same way dist/ already did: regenerated at release time and layered onto the release tag. main is now fully TypeScript-only.

Changes

• Pin @soroush.tech/bench@2.1.0 (now on npm) as an exact devDependency — re-vendoring becomes "bump the version".
• scripts/vendor.mjs copies from node_modules directly; the published package's exports map doesn't expose ./package.json, so the previous require.resolve approach broke against the real npm artifact.
• scripts/release-commit.mjs walks dist/ and vendor/ recursively (POSIX tree paths) when assembling the release commit.
• Release workflow: new "Vendor bench sandbox" step with existence checks before the release commit; CI gets the same as a smoke test.
• .gitignore /vendor/; committed copies removed.
• Version → 1.0.1 + release-notes/1.0.1.md (no action.yml contract change).

Verification

• The npm-built harness differs byte-wise from the previously committed monorepo snapshot (bundler difference) but carries all three gate flags (--baseline-case, --min-ratio, --md-file); the npm artifact is canonical going forward.
• Typecheck, 32 tests at 100% coverage, and build all green.
• Cold simulation: wiped node_modules + vendor/, then npm ci && npm run vendor regenerated everything — the exact path CI and the Release workflow take.
• Released tags (v1, v1.0.0) are unaffected; after merge, dispatch the Release workflow for 1.0.1 and verify the tag tree contains dist/index.cjs, vendor/Dockerfile, vendor/dist/harness.mjs.

[coderabbitai]

📝 Walkthrough

Walkthrough

The release process pins @soroush.tech/bench, regenerates vendor/, validates generated artifacts in CI and releases, and recursively includes dist/ and vendor/ in release commits. Both directories are now ignored on main, with updated development and release documentation.

Changes

Bench vendoring and release artifacts

Layer / File(s)	Summary
Pinned bench vendoring package.json, scripts/vendor.mjs, .gitignore, vendor/Dockerfile	Pins bench 2.1.0, adds installation validation, and makes generated vendor/ artifacts untracked on main.
Release artifact composition .github/workflows/release.yml, scripts/release-commit.mjs, README.md, release-notes/1.0.1.md	Runs vendoring during releases and recursively adds dist/ and vendor/ files to the release tree.
Validation and repository guidance .github/workflows/ci.yml, README.md, .github/workflows/release.yml	CI verifies vendored outputs, while documentation describes regeneration and tag-release behavior.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related issues

• Issue #4 — The vendor refresh and release-commit changes implement the described vendoring and release-tree behavior.
• Issue #5 — The release workflow’s generated-commit and tag flow is extended to include vendor/ artifacts.

Sequence Diagram(s)

sequenceDiagram
  participant ReleaseWorkflow
  participant VendorScript
  participant ReleaseCommit
  participant GitHubAPI
  ReleaseWorkflow->>VendorScript: run npm run vendor
  VendorScript-->>ReleaseWorkflow: generate vendor/Dockerfile and vendor/dist/harness.mjs
  ReleaseWorkflow->>ReleaseCommit: build release tree
  ReleaseCommit->>GitHubAPI: upload dist and vendor blobs
  GitHubAPI-->>ReleaseCommit: create release commit tree

Loading

🚥 Pre-merge checks | ✅ 3 | ❌ 2

❌ Failed checks (1 warning, 1 inconclusive)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 50.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.
Linked Issues check	❓ Inconclusive	Core release-time vendoring changes match #6, but exact lockfile pinning and byte-identical harness verification can't be confirmed because package-lock.json and vendor/dist/harness.mjs were filtered out.	Re-run review with package-lock.json and vendor/dist/harness.mjs included, or provide evidence that the lockfile pins @soroush.tech/bench@2.1.0 and the generated harness matches the published build.

✅ Passed checks (3 passed)

Check name	Status	Explanation
Out of Scope Changes check	✅ Passed	All changes support release-time vendoring, docs, versioning, and workflow updates; no unrelated code additions stand out.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: vendoring the bench package from npm during release.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/vendor-bench-at-release

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud