Fix the unstartable production build, clean up what it ships, and close the dependabot round-trip

.github/dependabot.yml

@@ -4,9 +4,49 @@ updates:
     directory: /
     schedule:
       interval: weekly
-  # The CAP app's own dependencies live in src/ (@sap/cds, jest, mbt, …); the
-  # published app lock is regenerated from here, so keep this manifest current.
+
+  # The builder's own dev dependencies (eslint, jest). No ecosystem covered
+  # this manifest until 2026-08, so nothing here was ever proposed for update
+  # -- it had drifted a full eslint major behind and carried two high
+  # advisories that a routine bump cleared. The PR gate (test.yml: lint +
+  # assemble + the app's jest suite) runs on these, so a bump that breaks the
+  # build is caught before merge.
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: weekly
+    groups:
+      builder-dev:
+        dependency-type: development
+
+  # The CAP app's own dependencies. They live HERE, in src/ -- the published
+  # app repo is regenerated on every publish, so a dependency bump merged
+  # over there is reverted by the next nightly (it happened: @cap-js/cds-test
+  # went to ^1.0.2 in cap2UI5/cap2UI5#67 and came back as ^1.0.1 in the
+  # publish commit two days later). src/package.json and src/package-lock.json
+  # are the only place an app dependency update survives.
+  #
+  # Grouped deliberately: @sap/* and @cap-js/* move together and a split PR
+  # per package produces a version skew that fails for reasons unrelated to
+  # either package.
   - package-ecosystem: npm
     directory: /src
     schedule:
       interval: weekly
+    open-pull-requests-limit: 5
+    groups:
+      cap:
+        patterns:
+          - "@sap/*"
+          - "@cap-js/*"
+      dev-dependencies:
+        dependency-type: development
+    ignore:
+      # openui5-dist pins the UI5 runtime served at /resources in local
+      # development (the deployed app gets UI5 from the `ui5` destination --
+      # scripts/vendor-core.js drops the package from the staged tree). The
+      # framework's supported-version story is tracked upstream in abap2UI5
+      # (floor 1.71), so bumping it is a deliberate decision with a
+      # compatibility question attached, not a routine dependency update --
+      # see the pin policy in builder-abap2UI5-js:AGENTS.md.
+      - dependency-name: openui5-dist

.github/workflows/test.yml

@@ -20,8 +20,8 @@ jobs:
   test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
-      - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version-file: src/.nvmrc
       # the builder's own dev deps (jest for the script tests, eslint)

.github/workflows/update_cap.yml

@@ -36,10 +36,10 @@ jobs:
   run:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: main
-      - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           # from src/.nvmrc — the app's own declared runtime, so the nightly
           # and the published app can never disagree on the Node version

AGENTS.md

@@ -25,7 +25,7 @@ that push starts `update_cap`.
 
 | Path | What it is | Hand-edit? |
 |---|---|---|
-| `src/` | hand-written SOURCE of the CAP app: skeleton (`server.js`, `z2ui5-service.*`, `db/`, `mta.yaml`, `xs-security.json`), platform wiring (draft store → CDS entity `cap2ui5.z2ui5_t_01`, app discovery → `srv/app/`), the custom app `srv/app/z2ui5_cl_app_read_odata.js`, app `README.md`, `.devcontainer/`, `AGENTS.md` (published into the app repo) | **yes — app changes go here** |
+| `src/` | hand-written SOURCE of the CAP app: skeleton (`server.js`, `z2ui5-service.*`, `db/`, `mta.yaml`, `xs-security.json`), platform wiring (draft store → CDS entity `cap2ui5.z2ui5_t_01`, app discovery → `srv/app/`), the custom app `srv/app/z2ui5_cl_app_read_odata.js`, the production-build step `scripts/vendor-core.js`, app `README.md`, `.devcontainer/`, `AGENTS.md` (published into the app repo) | **yes — app changes go here** |
 | `run/input/core/` | mirror of builder-abap2UI5-js:`core/` (committed; upstream sha in `run/input/UPSTREAM_COMMIT`) | never — rewritten by `npm run mirror_core` |
 | `run/output/cap2UI5/` | the assembled app (gitignored staging; `node_modules` preserved across builds) | never |
 | `scripts/` | `mirror-core.js`, `assemble-cap.js`, `publish-cap.js` | yes |
@@ -107,3 +107,43 @@ back to HEAD instead of failing. Keep both properties if you touch it.
 - Keep the rewrite pairs in `assemble-cap.js` in sync with the dependency
   paths if you ever move `run/input/core` or the vendored `core/`.
 - The app's jest suite gates every publish; keep it green.
+- A change to the CORE's own dependencies needs a coordinated refresh here:
+  `mirror_core` does not touch the frozen `"core"` entry in
+  `src/package-lock.json`, so assemble's drift guard fails the build until
+  someone runs `npm install` in `src/` in the same change set. That is the
+  guard working, not a bug — the merged `core/node_modules/*` entries and
+  the frozen entry have to agree or the app's `npm ci` breaks. Land the
+  mirror and the refreshed lock together.
+- The app carries `openui5-dist` as its own devDependency. The core stopped
+  declaring it as a runtime dependency (optional peer instead — see
+  builder-abap2UI5-js:AGENTS.md, "The UI5 runtime pin"), so this is what
+  keeps `cds watch` serving `/resources` locally. It must stay a
+  devDependency: production gets UI5 from the `ui5` destination, and the
+  package is 611 MB of deprecated tooling.
+- App dependency updates belong in `src/package.json` + `src/package-lock.json`
+  and nowhere else. The app repo is regenerated on every publish, so a bump
+  merged there is reverted by the next nightly — it happened to
+  `@cap-js/cds-test` (^1.0.2 in cap2UI5/cap2UI5#67, back to ^1.0.1 in the
+  publish commit two days later), which is why that repo's dependabot now
+  watches GitHub Actions only.
+
+## The production build (`npm run build:production`)
+
+`cds build --production` alone does not produce a startable module. It stages
+`gen/srv` with the app's `"abap2UI5": "file:./core"` dependency and never
+copies `core/` there, so the deployed module resolved the framework to a
+dangling symlink — `npm ci` creates it without checking the target, the
+archive builds, `cf deploy` succeeds, and the instance crash-loops on
+`Cannot find module 'abap2UI5/engine'`.
+
+`src/scripts/vendor-core.js` is the second half: it copies the vendored core
+into `gen/srv/core` and drops `openui5-dist` (611 MB of deprecated release
+tooling, 43 advisories, 3 critical) from the staged tree — the deployed
+server never serves `/resources`, xs-app.json routes it to the `ui5`
+destination. It bails out of that prune if the core ever declares a
+dependency other than `openui5-dist`, since the whole `core/node_modules/`
+subtree of the app lock is reachable only from that one package today.
+
+Gates: `src/test/production-build.test.js` in the app suite (so it runs on
+every PR and every publish) and the app repo's `deploy-check.yml`, which
+installs the staged module with `npm ci --omit=dev` and requires it.

eslint.config.js

@@ -19,7 +19,7 @@ module.exports = [
   },
   js.configs.recommended,
   {
-    files: ["scripts/**/*.js", "test/**/*.js", "src/srv/**/*.js", "src/test/**/*.js"],
+    files: ["scripts/**/*.js", "test/**/*.js", "src/scripts/**/*.js", "src/srv/**/*.js", "src/test/**/*.js"],
     languageOptions: {
       ecmaVersion: 2023,
       sourceType: "commonjs",