From cb41e32b3f947de23e6a9d8426642c04f16165c5 Mon Sep 17 00:00:00 2001
From: Philippe Serhal <philippe.serhal@gmail.com>
Date: Thu, 9 Apr 2026 07:58:24 -0400
Subject: [PATCH 1/2] ci: add e18e dependency diff workflow

See https://github.com/e18e/action-dependency-diff
---
 .github/workflows/dependency-diff.yml | 39 +++++++++++++++++++++++++++
 1 file changed, 39 insertions(+)
 create mode 100644 .github/workflows/dependency-diff.yml

diff --git a/.github/workflows/dependency-diff.yml b/.github/workflows/dependency-diff.yml
new file mode 100644
index 000000000..123ce85aa
--- /dev/null
+++ b/.github/workflows/dependency-diff.yml
@@ -0,0 +1,39 @@
+name: dependency-diff
+
+on:
+  pull_request:
+    branches:
+      - main
+      - release
+    paths:
+      - package.json
+      - pnpm-lock.yaml
+      - pnpm-workspace.yaml
+      - docs/package.json
+      - cli/package.json
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.number || github.sha }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+  pull-requests: write
+
+jobs:
+  dependency-diff:
+    name: 🔎 Dependency diff
+    runs-on: ubuntu-slim
+
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          fetch-depth: 0
+
+      - name: 🔎 Compare dependencies
+        uses: e18e/action-dependency-diff@d995338f3b229fe7b2cd82048df5da930f70c7c3 # v1.4.4
+        with:
+          detect-replacements: 'true'
+          duplicate-threshold: '4'
+          dependency-threshold: '15'
+          size-threshold: '200000'

From 29988260084d717807fb2a2f482bc8f27ccb8afb Mon Sep 17 00:00:00 2001
From: James Garbutt <43081j@users.noreply.github.com>
Date: Fri, 10 Apr 2026 12:14:21 +0100
Subject: [PATCH 2/2] chore: split it into tiny pieces of goodness

---
 .github/workflows/dependency-diff-comment.yml | 31 +++++++++++++++++++
 .github/workflows/dependency-diff.yml         | 10 +++++-
 2 files changed, 40 insertions(+), 1 deletion(-)
 create mode 100644 .github/workflows/dependency-diff-comment.yml

diff --git a/.github/workflows/dependency-diff-comment.yml b/.github/workflows/dependency-diff-comment.yml
new file mode 100644
index 000000000..484292967
--- /dev/null
+++ b/.github/workflows/dependency-diff-comment.yml
@@ -0,0 +1,31 @@
+name: dependency-diff-comment
+
+on:
+  workflow_run:
+    workflows: ['dependency-diff']
+    types:
+      - completed
+
+permissions:
+  pull-requests: write
+  actions: read
+
+jobs:
+  dependency-diff-comment:
+    name: 💬 Dependency diff comment
+    runs-on: ubuntu-slim
+    if: github.event.workflow_run.conclusion == 'success'
+
+    steps:
+      - name: 📥 Download artifact
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        with:
+          name: e18e-diff-result
+          run-id: ${{ github.event.workflow_run.id }}
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: 💬 Post comment
+        uses: e18e/action-dependency-diff@d995338f3b229fe7b2cd82048df5da930f70c7c3 # v1.4.4
+        with:
+          mode: comment-from-artifact
+          artifact-path: e18e-diff-result.json
diff --git a/.github/workflows/dependency-diff.yml b/.github/workflows/dependency-diff.yml
index 123ce85aa..e098a813d 100644
--- a/.github/workflows/dependency-diff.yml
+++ b/.github/workflows/dependency-diff.yml
@@ -18,7 +18,6 @@ concurrency:
 
 permissions:
   contents: read
-  pull-requests: write
 
 jobs:
   dependency-diff:
@@ -31,9 +30,18 @@ jobs:
           fetch-depth: 0
 
       - name: 🔎 Compare dependencies
+        id: analyze
         uses: e18e/action-dependency-diff@d995338f3b229fe7b2cd82048df5da930f70c7c3 # v1.4.4
         with:
+          mode: artifact
           detect-replacements: 'true'
           duplicate-threshold: '4'
           dependency-threshold: '15'
           size-threshold: '200000'
+
+      - name: 📤 Upload artifact
+        if: steps.analyze.outputs.artifact-path
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: e18e-diff-result
+          path: ${{ steps.analyze.outputs.artifact-path }}