CI: Disallow new dependencies in the root package.json

[manzoorwanijk]

Closes #75041

What?

Follow-up to #78615, which added the Workspace Development guide. Tracks against #75041 (Phase 7.1 — root-dependency enforcement).

Adds a CI check that fails when a PR adds a new entry under dependencies or devDependencies in the root package.json. The failure message points contributors at the Workspace Development guide, where the convention is documented in full.

Why?

Per #75041, the goal is to keep the root package.json lean and have each workspace declare the dependencies it uses. The new Workspace Development guide explains the convention; this PR makes it enforceable.

How?

• tools/validation/check-root-dependencies.mjs — reads the root package.json at HEAD and at the merge-base of HEAD and the given base ref (matching how GitHub's PR diff computes changes), then reports any newly-added keys under dependencies or devDependencies. Uses simple-git, already a @wordpress/validation-tools dependency, consistent with sibling check-local-changes.cjs. Moves between dependencies and devDependencies are not flagged. Defaults --base to origin/trunk.
• tools/validation/package.json — registers check-root-dependencies as a script on @wordpress/validation-tools.
• .github/workflows/static-checks.yml — runs the check as a step in the existing static-checks workflow, gated by matrix.annotations && github.event_name == 'pull_request' so it runs once per PR. The checkout's fetch-depth is bumped to 0 on that matrix entry (via case()) so the merge-base computation has enough history.

Folding the check into static-checks (rather than a dedicated workflow) means it runs on every PR regardless of which files are touched, and reuses the existing npm install so it adds essentially no overhead.

Testing Instructions

Run the check locally from the repo root:

1. Pass case (no new root deps):

   npm run --workspace @wordpress/validation-tools check-root-dependencies -- --base origin/trunk
   # → ✔ No new root dependencies.

2. Fail case — add a real package to root devDependencies (e.g. npm install --save-dev jsonc-parser) and rerun. The script exits 1 with the guidance message linking to the Workspace Development guide. Revert before committing.
3. Cross-section move (e.g. move chalk from devDependencies to dependencies) — should NOT be flagged.
4. Invalid base ref — script exits 2 with a clean error.

Testing Instructions for Keyboard

N/A — no UI changes.

Screenshots or screencast

N/A.

Use of AI Tools

Authored with assistance from Claude Code. The script, workflow integration, and PR description were drafted by the AI and iterated on through review (including a Codex review pass). All code has been read and tested by me.

[github-actions]

Size Change: -68 B (0%)

Total Size: 7.51 MB

📦 View Changed

Filename	Size	Change
build/scripts/editor/index.min.js	475 kB	-39 B (-0.01%)
build/scripts/media-utils/index.min.js	114 kB	-29 B (-0.03%)

_{compressed-size-action}

[Copilot]

Pull request overview

Adds a CI guardrail to keep the monorepo root package.json lean by failing PRs that introduce new root-level dependencies or devDependencies, nudging contributors toward declaring dependencies in the relevant tools/ or test/ workspace instead.

Changes:

• Registers a new check-root-dependencies npm script in @wordpress/validation-tools.
• Adds tools/validation/check-root-dependencies.mjs to compare root deps on HEAD vs a provided base ref via git show.
• Introduces a dedicated GitHub Actions workflow that runs the check when package.json changes in a PR.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
tools/validation/package.json	Adds a workspace script entry to run the new dependency check.
tools/validation/check-root-dependencies.mjs	Implements the “no new root deps” comparison logic and guidance output.
.github/workflows/check-root-dependencies.yml	Adds a PR workflow that triggers the check when root package.json is modified.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[manzoorwanijk]

Working example - https://github.com/WordPress/gutenberg/actions/runs/26379359077/job/77645513516?pr=78616

[github-actions]

Flaky tests detected in c4fcf93.
Some tests passed with failed attempts. The failures may not be related to this commit but are still reported for visibility. See the documentation for more information.

🔍 Workflow run URL: https://github.com/WordPress/gutenberg/actions/runs/28078756040
📝 Reported issues:

• [Flaky Test] Text blocks sync modifications between users #78855 in /test/e2e/specs/editor/collaboration/collaboration-block-gauntlet.spec.ts

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

[github-actions]

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

If you're merging code through a pull request on GitHub, copy and paste the following into the bottom of the merge commit message.

Co-authored-by: manzoorwanijk <manzoorwanijk@git.wordpress.org>
Co-authored-by: aduth <aduth@git.wordpress.org>
Co-authored-by: USERSATOSHI <tusharbharti@git.wordpress.org>
Co-authored-by: youknowriad <youknowriad@git.wordpress.org>
Co-authored-by: kushagra-goyal-14 <kush123@git.wordpress.org>

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.

[manzoorwanijk]

Moved this to draft until we complete #75041.

[manzoorwanijk]

This PR is now ready for review. We completed the cleanup of the root package.json via #75041 as much as we could as of now. Now, we want to guard it with this CI check to prevent dependencies being added to root package.json and the CI failure links to appropriate developer docs.

[manzoorwanijk]

Just a minor analysis: Before we started cleaning up the root package.json, we had 92 dependencies there.

gutenberg/package.json

Lines 39 to 132 in be1c20e

	"devDependencies": {
	"@apidevtools/json-schema-ref-parser": "11.6.4",
	"@babel/core": "7.25.7",
	"@emotion/is-prop-valid": "1.2.2",
	"@emotion/jest": "11.7.1",
	"@emotion/native": "11.0.0",
	"@inquirer/prompts": "7.2.0",
	"@octokit/rest": "16.26.0",
	"@playwright/test": "1.57.0",
	"@pmmmwh/react-refresh-webpack-plugin": "0.5.11",
	"@storybook/addon-a11y": "10.1.11",
	"@storybook/addon-docs": "10.1.11",
	"@storybook/icons": "2.0.1",
	"@storybook/react-vite": "10.1.11",
	"@testing-library/jest-dom": "^6.6.3",
	"@testing-library/react": "14.3.0",
	"@testing-library/user-event": "14.4.3",
	"@types/node": "^20.17.10",
	"@types/prettier": "2.4.4",
	"@types/react": "^18.3.27",
	"@types/react-dom": "^18.3.1",
	"@types/semver": "7.3.8",
	"@types/sprintf-js": "1.1.2",
	"@types/uuid": "8.3.1",
	"@vitejs/plugin-react": "5.1.2",
	"@wordpress/build": "file:./packages/wp-build",
	"ajv": "8.17.1",
	"babel-jest": "29.7.0",
	"babel-loader": "9.2.1",
	"babel-plugin-inline-json-import": "0.3.2",
	"chalk": "4.1.1",
	"change-case": "4.1.2",
	"commander": "9.2.0",
	"comment-parser": "^1.1.1",
	"concurrently": "3.5.0",
	"cross-env": "7.0.3",
	"cross-spawn": "^7.0.6",
	"css-loader": "^6.2.0",
	"esbuild": "^0.27.2",
	"eslint-import-resolver-typescript": "4.4.4",
	"eslint-plugin-eslint-comments": "3.1.2",
	"eslint-plugin-import": "2.25.2",
	"eslint-plugin-jest": "27.4.3",
	"eslint-plugin-jest-dom": "5.0.2",
	"eslint-plugin-prettier": "5.0.0",
	"eslint-plugin-react-compiler": "19.0.0-beta-0dec889-20241115",
	"eslint-plugin-ssr-friendly": "1.0.6",
	"eslint-plugin-storybook": "10.1.11",
	"eslint-plugin-testing-library": "6.0.2",
	"execa": "4.0.2",
	"fast-glob": "^3.2.7",
	"filenamify": "4.2.0",
	"glob": "7.1.2",
	"husky": "7.0.0",
	"jest": "29.6.2",
	"jest-environment-jsdom": "^30.2.0",
	"jest-jasmine2": "29.6.2",
	"jest-junit": "13.0.0",
	"jest-message-util": "^29.6.2",
	"jest-watch-typeahead": "2.2.2",
	"json2md": "2.0.1",
	"jsonc-parser": "3.3.1",
	"lerna": "8.1.9",
	"lint-staged": "10.0.2",
	"node-fetch": "2.7.0",
	"npm-run-all": "4.1.5",
	"patch-package": "8.0.0",
	"postcss-loader": "6.2.1",
	"prettier": "npm:wp-prettier@3.0.3",
	"raw-loader": "4.0.2",
	"react": "18.3.1",
	"react-docgen-typescript": "2.2.2",
	"react-dom": "18.3.1",
	"react-refresh": "0.14.0",
	"react-scanner": "1.2.0",
	"reassure": "0.7.1",
	"resize-observer-polyfill": "1.5.1",
	"rimraf": "5.0.10",
	"sass": "^1.54.0",
	"sass-embedded": "^1.97.2",
	"sass-loader": "16.0.3",
	"semver": "7.5.4",
	"simple-git": "3.24.0",
	"snapshot-diff": "0.10.0",
	"sprintf-js": "1.1.1",
	"storybook": "^10.1.11",
	"storybook-addon-tag-badges": "3.0.4",
	"style-loader": "3.2.1",
	"stylelint-plugin-logical-css": "^1.2.3",
	"typescript": "5.9.3",
	"uuid": "9.0.1",
	"vite": "7.3.0",
	"wait-on": "8.0.1"
	},

Right now, we have only 20, which we can further bring down a bit moving forward

gutenberg/package.json

Lines 64 to 85 in 2859317

	"devDependencies": {
	"@playwright/test": "^1.58.2",
	"@types/react": "^18.3.27",
	"@types/react-dom": "^18.3.1",
	"@typescript/native-preview": "^7.0.0-dev.20260423.1",
	"@wordpress/env": "file:./packages/env",
	"@wordpress/eslint-tools": "file:./tools/eslint",
	"@wordpress/release-tools": "file:./tools/release",
	"@wordpress/scripts": "file:./packages/scripts",
	"@wordpress/stylelint-tools": "file:./tools/stylelint",
	"concurrently": "^3.5.0",
	"cross-env": "^7.0.3",
	"husky": "^7.0.0",
	"lerna": "^9.0.7",
	"lint-staged": "^16.4.0",
	"npm-run-all": "^4.1.5",
	"patch-package": "^8.0.0",
	"rimraf": "^5.0.10",
	"syncpack": "^15.3.1",
	"typescript": "^6.0.2",
	"wait-on": "^8.0.1"
	},

[aduth]

LGTM 👍 Tested locally with pass/fail scenarios. Bonus points we could add a temporary commit here with an added dependency to see how CI treats it.

[aduth]

This isn't "full" history, is it? It looks like it's just trunk head + 1 ?

[manzoorwanijk]

It is: fetch-depth: 0 = full history on the annotation PR run; the '1' is just the fallback for runs that don't execute the check.

[aduth]

Do we need to fetch the full history? Alternatively, couldn't we still get the relevant history after the initial checkout from the script itself?

I just checked, and this change increased the time spent in actions/checkout step for Node.js 24 on Linux by 34x (2s to 1m8s). I don't think that's tolerable.

[manzoorwanijk]

Agreed. I will create a follow up to improve that.

[manzoorwanijk]

Failure works - https://github.com/WordPress/gutenberg/actions/runs/28078160163/job/83126806622?pr=78616