[eersnington]

Add .github/workflows/pipboy.yml and scripts/pipboy. Each PR gets one comment that shows what the change does to the npm packages we publish.

flowchart LR
  changes --> footprint --> report --> comment["PR comment"]
  main["push to main"] -. baseline tarballs .-> footprint

Loading

• pipboy pack builds and packs every package that discoverPackages in scripts/publish returns.
• pipboy footprint resolves each package with npm install --package-lock-only against the merge base and @latest, on 5 platforms. Sizes come from the registry's unpackedSize. Nothing is downloaded.
• WASM commands and default software are copied from the latest published runtime-core and core tarballs (ASSET_SEEDS in config.ts), so pack never compiles wasm.
• The comment names the dependency and the floating 0.x range behind a size change, and flags an entrypoint that points to a file the package does not ship.
• The job fails only when the PR pushes a package over its entry in BUDGETS.

pnpm --filter pipboy pipboy pack --out /tmp/pr
pnpm --filter pipboy pipboy footprint --pr /tmp/pr --base /tmp/base --out footprint.json

Security

• Jobs run on pull_request and push only. Only report gets pull-requests: write, and it builds nothing. Actions are pinned by SHA and checked by zizmor.

---

This is part 1 of 4 in a stack:

•  4  ci(pipboy): add per-commit CI trace command #2063
•  3  ci(pipboy): add native binary sizes #2062
•  2  ci(pipboy): add rust dependency hygiene #2061
•  1  ci(pipboy): add package footprint #2060 👈

[railway-app]

This PR was not deployed automatically as @eersnington does not have access to the Railway project.

In order to get automatic PR deploys, please add @eersnington to your workspace on Railway.

[github-actions]

📟 Pip-Boy · aaae4d8

📦 Packages · fresh npm install resolve, no lockfile · this PR vs base

No notable install size, dependency, or entrypoint changes across 6 packages.

All 6 packages · linux-x64-gnu

package (linux-x64-gnu)	@latest	base	this PR	Δ vs base	packages
@rivet-dev/agentos-core	458.2 MB	458.2 MB	458.2 MB	0	121 (0)
@rivet-dev/agentos-node-pty	7.6 KB	18.0 KB	18.0 KB	0	1 (0)
@rivet-dev/agentos-posix	253.6 MB	253.6 MB	253.6 MB	0	7 (0)
@rivet-dev/agentos-runtime-core	253.6 MB	253.6 MB	253.6 MB	0	6 (0)
@rivet-dev/agentos-sandbox	495.5 MB	495.5 MB	495.5 MB	0	177 (0)
@rivet-dev/agentos-toolchain	130.8 KB	141.2 KB	141.2 KB	0	2 (0)

🧹 Rust dependencies · cargo deny + cargo shear

check	new in this PR	fixed	existing on base
advisories	✅ 0	0	26
licenses	✅ 0	499	0
sources	✅ 0	0	0
bans	✅ 0	0	0
unused	✅ 0	0	16

🦀 Binaries · publish Dockerfiles, --release

No native build on main to compare against yet.

artifact	npm @latest	base	this PR	Δ vs base
agentos-native-sidecar linux-x64-gnu	143.6 MB	—	143.6 MB	—

⏱ Timing

job	wall time	slowest step
zizmor	11s	checkout · 3s
changes	26s	checkout · 23s
self-test	27s	Run pnpm --filter pipboy test · 11s
native · linux-x64-gnu	12m56s	Build with the publish Dockerfile · 12m33s
footprint	2m24s	Pack this commit · 41s
hygiene	57s	checkout · 24s
report	22s	setup-node · 7s

🔭 Full CI trace for this commit

One OpenTelemetry trace of CI and Pip-Boy for aaae4d8: every job and step, with the sizes above attached. Run after CI finishes.

pnpm install --frozen-lockfile --filter 'pipboy...'
pnpm --filter pipboy pipboy trace --sha aaae4d8fd033cfb3919c9029addfff5606034faf

Add --otlp <url> to send it to any OTLP/HTTP collector.

Agent instruction: From a rivet-dev/agentos checkout, run the commands above, then read the trace file the last command prints. List the slowest jobs and steps and explain where CI time went.