Source JavaScript modules from npm

[silverwind]

JavaScript modules are currently manually placed in public/vendor/plugins and updating them is not straightfoward as one needs to both manually copy new files and update the licences page. I'd suggest:

• Populate public/vendor/plugins by adding all modules to package.json and copying the relevant files from node_modules in a make task.
• Remove the JavaScript Licences page, I don't think it is actually useful and just cumbersome to update.

[techknowlogick]

I'm in favour of moving to npm for JS modules (in fact I recently forked a project to do exactly this to it), however the JavaScript Licences page is a requirement that we provide a list of the licenses used (perhaps this could be autogenerated from package.json info of each project).

[silverwind]

Yes, most npm packages have license info in their package.json. Would you think the license name and a link to the package homepage would suffice? I guess not all packages would feature a LICENSE file.

[silverwind]

I'm thinking of going one step further and adding a minimal webpack build process. It could produce a single bundle.min.js that we commit to git.

[apricote]

Committing the bundle.min.js will cause more conflicts in PRs, in the same way that it currently happens with the css bundle. Not a blocker, just something to think about.

[silverwind]

Yeah, I don't like committing build files either. We could require Node.js and a Internet connection to compile both CSS and JS during the build.

[apricote]

The build server could generate the files and commit them for master branch builds.

Upsides:

• No more conflicts in PRs that touch these files,
• contributers that work on Go code won't need Node.js,
• our security improves slightly, because people can not hide malicious code in the minified JS bundle.

Downsides:

• Reviewers will have to build it locally

[CL-Jeremy]

The build server could generate the files and commit them for master branch builds.

Does this also mean these files will be added to .gitignore, while CI builds will do git add --force? That'd liberate me from doing git checkout HEAD -- <files> whenever those files get generated.

[silverwind]

This is in progress. Not all libs are sourceable from npm but some might be. We can handle them on a case-per-case basis, no need to keep this open.