Fix Vite build failure and enhance yarn-update workflow

[Copilot]

Vite build fails because CSS files import from vendor/filament/* paths before composer install runs in the release workflow. The workflow was executing yarn build then composer install, causing path resolution errors.

Changes

Reordered release workflow build steps:

• Moved PHP setup and Composer installation to run before Node.js setup and frontend build
• Ensures vendor directory with Filament CSS files exists when yarn build executes
• CSS vendor imports remain unchanged and functional

Workflow order changed from:

1. Node.js setup
2. Yarn install
3. Yarn build ❌ (fails - vendor doesn't exist)
4. PHP setup
5. Composer install

To:

1. PHP setup
2. Composer install (creates vendor directory)
3. Node.js setup
4. Yarn install
5. Yarn build ✅ (succeeds - vendor exists)

Enhanced yarn-update workflow:

• Added package-lock.json conflict detection with prominent warnings
• New update type options: security-updates (default), common-packages, patch-minor, all-latest-with-build
• Security updates now identify and upgrade vulnerable packages from audit reports
• Improved logging with clear section separators for all steps
• Lock file conflict warnings displayed in PR body with remediation checklist
• Build step shows completion confirmation

The build now works correctly because the vendor directory with all Filament CSS files exists when Vite tries to resolve the import statements during the build process. The yarn-update workflow now provides better visibility and handles package manager conflicts gracefully.

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[nielsdrost7]

@copilot
I don't agree with removing those references to the vendor folder. The folder is there, once composer install gets run.
My prompt was meant to say that composer install needs to run before anything with yarn gets done.

[Copilot]

@copilot
I don't agree with removing those references to the vendor folder. The folder is there, once composer install gets run.
My prompt was meant to say that composer install needs to run *...

You're absolutely right. I misunderstood the issue. Fixed in commit e89b1af.

I've reverted all CSS changes and instead fixed the workflow build order. The release workflow now runs composer install before yarn build:

New order:

1. PHP setup
2. Composer install (creates vendor directory)
3. Node.js setup
4. Yarn install
5. Yarn build (can now resolve vendor CSS imports)

The CSS vendor imports are back to their original state, and the build will work correctly now that the vendor directory exists when needed.

[nielsdrost7]

@copilot make a special log and also show in the screen when 1 of the steps is whining about package-lock.json. isn't yarn.lock enough?
Also better reflect the choices.

• I think a "security updates" could be a good choice
• "upgrade all to latest and build production" could be a good choice

[Copilot]

@copilot make a special log and also show in the screen when 1 of the steps is whining about package-lock.json. isn't yarn.lock enough?
Also better reflect the choices.

...

Fixed in commit 233a635.

Changes made to yarn-update.yml:

1. Package-lock.json detection and warnings:

   • New step logs warnings when package-lock.json exists alongside yarn.lock
   • Shows file modification date and explains the conflict
   • Warnings appear in both workflow logs and PR descriptions

2. Better update type choices:

   • Added security-updates (new default for scheduled runs)
   • Kept common-packages and patch-minor
   • Renamed all-dependencies to all-latest-with-build for clarity

3. Enhanced logging:

   • All steps now have clear section separators (=========)
   • Security updates identify and upgrade vulnerable packages
   • Build step shows completion confirmation

The workflow will now warn about package-lock.json whenever it runs, and the PR description will include a checklist item to remove it if not needed.