feat: Add Lighthouse CI and performance optimizations#11
Conversation
- Add Lighthouse CI to GitHub Actions workflow with performance assertions - Optimize font loading with async pattern (non-blocking) - Add DNS prefetch for external resources - Split bundles: icons (lucide-react), utils (clsx, tailwind-merge, cva) - Target ES2022 for smaller bundle output - Move SEO docs to docs/ directory - Remove unused test images - Update .gitignore for Lighthouse CI output Bundle size improvements: - Main bundle: 231KB → 204KB (-12%) - gzip: 73KB → 65KB (-8KB) 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Deploying with
|
| Status | Name | Latest Commit | Preview URL | Updated (UTC) |
|---|---|---|---|---|
| ✅ Deployment successful! View logs |
devcard | 88a14c4 | Commit Preview URL Branch Preview URL |
Jan 03 2026, 07:35 AM |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| runs-on: ubuntu-latest | ||
| needs: ci | ||
|
|
||
| steps: | ||
| - name: Checkout | ||
| uses: actions/checkout@v4 | ||
|
|
||
| - name: Download build artifacts | ||
| uses: actions/download-artifact@v4 | ||
| with: | ||
| name: dist | ||
| path: dist | ||
|
|
||
| - name: Setup Node.js | ||
| uses: actions/setup-node@v4 | ||
| with: | ||
| node-version: 20 | ||
|
|
||
| - name: Install Lighthouse CI | ||
| run: npm install -g @lhci/cli@0.14.x | ||
|
|
||
| - name: Run Lighthouse CI | ||
| run: lhci autorun | ||
| env: | ||
| LHCI_GITHUB_APP_TOKEN: ${{ secrets.LHCI_GITHUB_APP_TOKEN }} | ||
|
|
||
| - name: Upload Lighthouse report | ||
| uses: actions/upload-artifact@v4 | ||
| if: always() | ||
| with: | ||
| name: lighthouse-report | ||
| path: .lighthouseci | ||
| retention-days: 7 |
Check warning
Code scanning / CodeQL
Workflow does not contain permissions Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 3 months ago
In general, the fix is to declare an explicit permissions block in the workflow so that the GITHUB_TOKEN has only the minimal rights needed. For this CI workflow, both jobs only need to read the repository contents (for checkout) and do not need to write to the repo, issues, or pull requests. Artifact upload/download uses the workflow’s internal permissions and does not require repository write scopes. Therefore we can safely set contents: read at the workflow level, which will apply to both ci and lighthouse jobs.
The best fix with minimal functional change is to add a root-level permissions key after the name: CI line and before the on: block in .github/workflows/ci.yml:
- Add:
at the top level of the workflow.
permissions: contents: read
- No changes to the job steps are required.
- No imports or additional methods are needed since this is purely a YAML configuration change.
| @@ -1,5 +1,8 @@ | ||
| name: CI | ||
|
|
||
| permissions: | ||
| contents: read | ||
|
|
||
| on: | ||
| push: | ||
| branches: [main] |
1 participant
Summary
docs/directoryPerformance Improvements
Lighthouse CI Configuration
Test plan
🤖 Generated with Claude Code