chore(packaging): trim packaged node_modules

.github/workflows/build.yml

@@ -29,16 +29,19 @@ jobs:
             platform: macOS
             package-cmd: vp run package:macos --publish=never -c.mac.identity=null
             cleanup-path: dist/mac-universal
+            verify-path: dist/mac-universal/Gitify.app
             artifact-name: Gitify-dist-mac
           - os: windows-latest
             platform: Windows
             package-cmd: vp run package:win --publish=never
             cleanup-path: dist/win-unpacked
+            verify-path: dist/win-unpacked
             artifact-name: Gitify-dist-win
           - os: ubuntu-latest
             platform: Linux
             package-cmd: vp run package:linux --publish=never
             cleanup-path: dist/linux-unpacked
+            verify-path: dist/linux-unpacked
             artifact-name: Gitify-dist-linux
     runs-on: ${{ matrix.os }}
 
@@ -63,6 +66,10 @@ jobs:
           CSC_LINK: ${{ matrix.platform == 'macOS' && secrets.CSC_LINK || (matrix.platform == 'windows' && secrets.WIN_CSC_LINK || '') }}
           CSC_KEY_PASSWORD: ${{ matrix.platform == 'macOS' && secrets.CSC_KEY_PASSWORD || (matrix.platform == 'windows' && secrets.WIN_CSC_KEY_PASSWORD || '') }}
 
+      - name: Verify packaged dependencies
+        shell: bash
+        run: node scripts/verifyPackagedDependencies.js "${{ matrix.verify-path }}"
+
       - name: Clean up builds
         shell: bash
         run: rm -rfv ${{ matrix.cleanup-path }}

.github/workflows/publish.yml

@@ -46,16 +46,19 @@ jobs:
           - os: macos-latest
             platform: macOS
             package-cmd: vp run package:macos --publish onTagOrDraft
+            verify-path: dist/mac-universal/Gitify.app
             artifact-name: Gitify-release-mac
             use-apple-notarization: true
           - os: windows-latest
             platform: Windows
             package-cmd: vp run package:win --publish onTagOrDraft
+            verify-path: dist/win-unpacked
             artifact-name: Gitify-release-win
             use-apple-notarization: false
           - os: ubuntu-latest
             platform: Linux
             package-cmd: vp run package:linux --publish onTagOrDraft
+            verify-path: dist/linux-unpacked
             artifact-name: Gitify-release-linux
             use-apple-notarization: false
     runs-on: ${{ matrix.os }}
@@ -91,6 +94,10 @@ jobs:
           # General
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
+      - name: Verify packaged dependencies
+        shell: bash
+        run: node scripts/verifyPackagedDependencies.js "${{ matrix.verify-path }}"
+
       - name: Upload artifacts
         uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:

CONTRIBUTING.md

@@ -91,6 +91,23 @@ guard fails the run outside Linux rather than letting that happen.
 Note that these baselines capture the `backdrop-filter` fallback for Glass, not
 the macOS native vibrancy material, which Chromium cannot render.
 
+### 📦 Dependencies and packaging
+
+The packaged app ships only the packages that are loaded from disk at runtime.
+Declare main-process runtime dependencies in `dependencies`; packages that Vite
+bundles into the renderer belong in `devDependencies`, even though the renderer
+imports them. The current runtime packages are `electron-log`,
+`electron-menubar`, and `electron-updater`; `cn`, `react`, `react-dom`, and
+`react-router-dom` are renderer-only and build-time.
+
+`electron-builder` collects the production closure from `dependencies` through
+its pnpm collector. Do not add `node_modules` to the `files` list in
+`electron-builder.js` — a hand-written glob overrides that collector and can
+re-introduce dev dependencies. After packaging, run
+`node scripts/verifyPackagedDependencies.js <app path>` to assert that the asar
+contains the runtime packages and none of the renderer-only packages or the pnpm
+virtual store.
+
 ### 🎨 Code Style & Conventions
 
 - Linting and formatting are configured in `vite.config.mts` (the `lint` and `fmt` blocks). Please run `pnpm check` before submitting a PR.

electron-builder.js

@@ -6,14 +6,7 @@ const config = {
   appId: 'com.electron.gitify',
   copyright: 'Copyright © 2026 Gitify Team',
   asar: true,
-  files: [
-    'assets/images/*',
-    'assets/sounds/*',
-    'build/**/*',
-    'LICENSE',
-    'node_modules/**/*', // Ideally we would have !node_modules and let electron-builder prune deps
-    'package.json',
-  ],
+  files: ['assets/images/*', 'assets/sounds/*', 'build/**/*', 'LICENSE', 'package.json'],
   electronLanguages: ['en'],
   protocols: [
     {

package.json

@@ -75,13 +75,9 @@
     "test:visual:update": "scripts/visual.sh --update"
   },
   "dependencies": {
-    "cn": "0.5.0",
     "electron-log": "5.4.4",
     "electron-menubar": "11.1.2",
-    "electron-updater": "6.8.11",
-    "react": "19.3.1",
-    "react-dom": "19.3.1",
-    "react-router-dom": "7.18.4"
+    "electron-updater": "6.8.11"
   },
   "devDependencies": {
     "@discordapp/twemoji": "16.0.1",
@@ -119,6 +115,7 @@
     "@vitejs/plugin-react": "6.1.2",
     "@vitest/browser-playwright": "catalog:",
     "@vitest/coverage-v8": "catalog:",
+    "cn": "0.5.0",
     "concurrently": "10.0.6",
     "date-fns": "4.4.0",
     "dotenv": "18.0.9",
@@ -130,7 +127,10 @@
     "happy-dom": "21.0.4",
     "husky": "9.1.7",
     "playwright": "1.64.1",
+    "react": "19.3.1",
     "react-devtools": "8.0.0",
+    "react-dom": "19.3.1",
+    "react-router-dom": "7.18.4",
     "rimraf": "6.1.3",
     "semver": "7.8.5",
     "tailwindcss": "4.3.3",