ci: add Codecov bundle analysis via vite plugin

.github/workflows/bundle-analysis.yml

@@ -0,0 +1,45 @@
+# SPDX-FileCopyrightText: 2026 Nextcloud cookbook contributors
+#
+# SPDX-License-Identifier: AGPL-3.0-only OR AGPL-3.0-or-later
+
+name: Bundle analysis
+
+on:
+  push:
+    branches:
+      - master
+  workflow_dispatch:
+
+permissions: {}
+
+jobs:
+  upload-bundle-stats:
+    name: Upload bundle stats to Codecov
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
+
+    steps:
+      - name: Checkout the app
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Read package.json node and npm engines version
+        uses: skjnldsv/read-package-engines-version-actions@06d6db44aa62f4609ba070f556ec24bc99fb85cb # v4
+        id: versions
+
+      - name: Set up node ${{ steps.versions.outputs.nodeVersion }}
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+        with:
+          node-version: ${{ steps.versions.outputs.nodeVersion }}
+
+      - name: Set up npm ${{ steps.versions.outputs.npmVersion }}
+        run: npm i -g --ignore-scripts 'npm@${{ steps.versions.outputs.npmVersion }}'
+
+      - name: Install the NPM dependencies
+        run: npm ci --ignore-scripts
+
+      - name: Build and upload bundle stats
+        run: npm run build

.github/workflows/tests.yml

@@ -444,6 +444,9 @@ jobs:
   source-package:
     name: Create source code artifacts
     runs-on: ubuntu-latest
+    permissions:
+        contents: read
+        id-token: write
 
     steps:
         -   name: Checkout the app
@@ -469,7 +472,7 @@ jobs:
         -   name: Set up npm ${{ steps.versions.outputs.npmVersion }}
             # Skip if no package.json
             if: ${{ steps.versions.outputs.npmVersion }}
-            run: npm i -g 'npm@${{ steps.versions.outputs.npmVersion }}'
+            run: npm i -g --ignore-scripts 'npm@${{ steps.versions.outputs.npmVersion }}'
 
         -   name: Get the date
             id: date
@@ -497,7 +500,7 @@ jobs:
         -   name: Install the NPM dependencies
             shell: bash
             run: >-
-                npm ci
+                npm ci --ignore-scripts
         -   name: Install the dependencies for composer
             shell: bash
             run: >-