Unused Dependencies Cleanup (depcheck)

This workflow scans each workspace for unused dependencies using depcheck and opens a PR to remove them.

Why

• Keep package.json lean and secure.
• Reduce install times and noise from automated upgrades.
• Surface potential misconfigurations (e.g., missing or indirectly used deps).

How it works

1. Detect all workspaces with a package.json in apps/* and packages/*.
2. Run depcheck --json per workspace, respecting optional ignore files.
3. Generate a Markdown report and upload it as an artifact.
4. If unused deps are found, rewrite the affected package.json files, update the lockfile, and create a PR.
5. Create/update a tracking issue with the summary.

Configure ignores (border cases)

• Global defaults are embedded in the workflow to ignore common toolchain-only packages.
• For workspace-specific exceptions, create a .depcheckrc.workspace file in that workspace:

{
  "ignores": ["your-dependency-name", "another-dep"]
}

You can also include skipMissing and ignorePatterns if needed.

Workflow location

• File: .github/workflows/unused-deps.yml
• Triggers:
  • Manual dispatch
  • Pushes to main/master that change package.json or pnpm-lock.yaml

Notes

• depcheck flags may include false positives for dynamically loaded or config-only packages; review the PR carefully.
• The PR is created with peter-evans/create-pull-request so repository actions must allow PR creation.
• In monorepos, running per workspace avoids cross-package interference.