Remove Codecov integration and add dependency diff workflow

.github/workflows/test.yml

@@ -22,10 +22,6 @@ jobs:
           node-version: 22
       - run: npm ci --ignore-scripts --no-audit --no-fund
       - run: npm test
-      - name: Upload coverage reports to Codecov
-        uses: codecov/codecov-action@v5.5.3
-        with:
-          token: ${{ secrets.CODECOV_TOKEN }}
 
   check:
     name: Check types
@@ -41,7 +37,7 @@ jobs:
       - run: npm run check
 
   build:
-    name: Build & collect coverage
+    name: Build
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6
@@ -52,8 +48,36 @@ jobs:
           node-version: 22
       - run: npm ci --ignore-scripts --no-audit --no-fund
       - run: npm run build
-        env:
-          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
+      - name: Pack
+        run: npm pack
+      - name: Upload pack artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: source-packages
+          path: '*.tgz'
+
+  build-base:
+    name: Build (base branch)
+    runs-on: ubuntu-latest
+    if: github.event_name == 'pull_request'
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          ref: ${{ github.base_ref }}
+      - name: Use Node.js
+        uses: actions/setup-node@v6
+        with:
+          cache: 'npm'
+          node-version: 22
+      - run: npm ci --ignore-scripts --no-audit --no-fund
+      - run: npm run build
+      - name: Pack
+        run: npm pack
+      - name: Upload pack artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: base-packages
+          path: '*.tgz'
 
   lint:
     name: Lint
@@ -81,3 +105,30 @@ jobs:
           cache: 'npm'
           node-version: 22
       - run: npm audit --audit-level=high
+
+  dependency-diff:
+    name: Dependency & bundle diff
+    runs-on: ubuntu-latest
+    if: github.event_name == 'pull_request'
+    needs: [build, build-base]
+    permissions:
+      pull-requests: write
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+      - uses: actions/download-artifact@v4
+        with:
+          name: base-packages
+          path: ./base-packages
+      - uses: actions/download-artifact@v4
+        with:
+          name: source-packages
+          path: ./source-packages
+      - name: Run dependency & bundle diff
+        uses: e18e/action-dependency-diff@v1
+        with:
+          base-packages: './base-packages/*.tgz'
+          source-packages: './source-packages/*.tgz'
+          pack-size-threshold: -1
+          size-threshold: -1