Add CI check to ensure no devDependency is required in production

[mtrezza]

New Feature / Enhancement Checklist

• I am not disclosing a vulnerability.
• I am not just asking a question.
• I have searched through existing issues.

Current Limitation

The CI currently installs all dependencies including devDependendies, which are required to run tests. Therefore, if a dependency is required for a production deployment, but has accidentally been added to devDependendies instead of dependendies, the CI cannot not detect that and Parse Server may crash in a production deployment.

Feature / Enhancement Description

Add CI check that ensures all dependencies that are required for a production deployment are added in under dependendies and none of the devDependendies is required.

Maybe a tool like https://www.npmjs.com/package/dependency-check can make this easy to implement.

Example Use Case

See issue #7786

Alternatives / Workarounds

• manually ensure during review that prod dependency is not added to dev dependency

[parse-github-assistant]

Thanks for opening this issue!

• 🎉 We are excited about your ideas for improvement!

[Moumouls]

@mtrezza, I completely forgot that an eslint rule exists for this use case !

Eslint will also helps to warn the developer directly in the IDE

https://github.com/import-js/eslint-plugin-import/blob/main/docs/rules/no-extraneous-dependencies.md

[mtrezza]

Even better! I had a quick look but not sure how to set the rule options for our use case.

[Moumouls]

for this eslint rule @mtrezza we need to exclude the spec folder, as the docs suggest, in our case this one should works

"import/no-extraneous-dependencies": ["error", {"devDependencies": ["spec/*.js"]}]

Then it should throw an error if we import a devDep anywhere in the project (or atleast src) exept in spec folder

EDIT: It will not cover missing peer dep in production usage, but in our case @apollo was already imported directly, eslint will be able to prevent the issue first. Also peerdeps in common use cases are also required directly in the project (like react, apollo) and common utils when you work with a specific technology. So i'm convinced that the eslint rule in 99% of the time will catch a missing prod peer dep.

[mtrezza]

"import/no-extraneous-dependencies": ["error", {"devDependencies": ["spec/*.js"]}]

That looks good; and according to the docs it seems to consider import and require.