@slashgear/gdpr-cookie-scanner 3.8.0 → 3.8.2

package/.github/workflows/ci.yml

@@ -15,38 +15,44 @@ jobs:
     steps:
       - uses: actions/checkout@v6
 
-      - uses: pnpm/action-setup@v4
+      - uses: oven-sh/setup-bun@v2
         with:
-          version: latest
+          bun-version: 1.3.14
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v6
         with:
           node-version: 24
-          cache: pnpm
 
       - name: Install dependencies
-        run: pnpm install --frozen-lockfile
+        run: bun install --frozen-lockfile
 
       - name: Format check
-        run: pnpm format:check
+        run: bun run format:check
 
       - name: Lint
-        run: pnpm lint
+        run: bun run lint
 
       - name: Type check
-        run: pnpm typecheck
+        run: bun run typecheck
 
       - name: Build
-        run: pnpm build
+        run: bun run build
+
+      - name: Cache Playwright browsers
+        uses: actions/cache@v4
+        with:
+          path: ~/.cache/ms-playwright
+          key: playwright-${{ runner.os }}-${{ hashFiles('bun.lock') }}
 
       - name: Install Playwright browsers
-        run: pnpm exec playwright install chromium --with-deps
+        timeout-minutes: 10
+        run: npx playwright install chromium-headless-shell
 
       - name: Test
         id: test
         run: |
           start=$(date +%s)
-          pnpm test
+          bun run test
           echo "duration=$(( $(date +%s) - start ))" >> "$GITHUB_OUTPUT"
 
       - name: Record test suite duration

package/.github/workflows/release.yml

@@ -15,27 +15,26 @@ jobs:
     steps:
       - uses: actions/checkout@v6
 
-      - uses: pnpm/action-setup@v4
+      - uses: oven-sh/setup-bun@v2
         with:
-          version: latest
+          bun-version: 1.3.14
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v6
         with:
           node-version: 24
-          cache: pnpm
           registry-url: https://registry.npmjs.org
 
       - name: Install dependencies
-        run: pnpm install --frozen-lockfile
+        run: bun install --frozen-lockfile
 
       - name: Build
-        run: pnpm build
+        run: bun run build
 
       - name: Create release PR or publish to npm
         id: changesets
         uses: changesets/action@v1
         with:
-          publish: pnpm changeset publish
+          publish: bunx changeset publish
           title: "chore: release new version"
           commit: "chore: release new version"
           createGithubReleases: true

package/.github/workflows/update-cookie-db.yml

@@ -16,20 +16,19 @@ jobs:
     steps:
       - uses: actions/checkout@v6
 
-      - uses: pnpm/action-setup@v4
+      - uses: oven-sh/setup-bun@v2
         with:
-          version: latest
+          bun-version: 1.3.14
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v6
         with:
           node-version: 24
-          cache: pnpm
 
       - name: Install dependencies
-        run: pnpm install --frozen-lockfile
+        run: bun install --frozen-lockfile
 
       - name: Fetch Open Cookie Database
-        run: pnpm update:ocd
+        run: bun run update:ocd
 
       - name: Detect changes
         id: diff
@@ -40,11 +39,11 @@ jobs:
 
       - name: Type-check
         if: steps.diff.outputs.changed == 'true'
-        run: pnpm typecheck
+        run: bun run typecheck
 
       - name: Format
         if: steps.diff.outputs.changed == 'true'
-        run: pnpm format
+        run: bun run format
 
       - name: Create PR
         if: steps.diff.outputs.changed == 'true'
@@ -84,8 +83,8 @@ jobs:
 
           ## Test plan
 
-          - [ ] `pnpm typecheck` passes (validated by CI)
-          - [ ] `pnpm build` produces `dist/data/open-cookie-database.json`
+          - [ ] `bun run typecheck` passes (validated by CI)
+          - [ ] `bun run build` produces `dist/data/open-cookie-database.json`
           - [ ] Spot-check a few cookie descriptions in the updated file
 
           🤖 Generated with [Claude Code](https://claude.com/claude-code)

package/.github/workflows/update-trackers.yml

@@ -16,20 +16,19 @@ jobs:
     steps:
       - uses: actions/checkout@v6
 
-      - uses: pnpm/action-setup@v4
+      - uses: oven-sh/setup-bun@v2
         with:
-          version: latest
+          bun-version: 1.3.14
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v6
         with:
           node-version: 24
-          cache: pnpm
 
       - name: Install dependencies
-        run: pnpm install --frozen-lockfile
+        run: bun install --frozen-lockfile
 
       - name: Fetch & merge tracker lists
-        run: pnpm update-trackers
+        run: bun run update-trackers
 
       - name: Detect changes
         id: diff
@@ -40,11 +39,11 @@ jobs:
 
       - name: Format
         if: steps.diff.outputs.changed == 'true'
-        run: pnpm format
+        run: bun run format
 
       - name: Type-check
         if: steps.diff.outputs.changed == 'true'
-        run: pnpm typecheck
+        run: bun run typecheck
 
       - name: Create PR
         if: steps.diff.outputs.changed == 'true'
@@ -85,7 +84,7 @@ jobs:
 
           ## Test plan
 
-          - [ ] `pnpm typecheck` passes (validated by CI)
+          - [ ] `bun run typecheck` passes (validated by CI)
           - [ ] Review the diff in `tracker-list.ts` for obviously incorrect category assignments
           - [ ] Spot-check 2–3 new domains against their actual tracker type
 

package/.github/workflows/website.yml

@@ -4,77 +4,35 @@ on:
   push:
     branches: [main]
     paths:
-      - "website/**"
-      - "pnpm-workspace.yaml"
+      - "website/public/**"
       - ".github/workflows/website.yml"
 
-env:
-  SCW_DEFAULT_REGION: fr-par
+permissions:
+  contents: read
+  pages: write
+  id-token: write
+
+concurrency:
+  group: pages
+  cancel-in-progress: true
 
 jobs:
-  build-and-push:
+  deploy:
     runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      packages: write
-
-    outputs:
-      image: ${{ steps.meta.outputs.image }}
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
 
     steps:
       - uses: actions/checkout@v6
         with:
           lfs: true
 
-      - name: Log in to GitHub Container Registry
-        uses: docker/login-action@v3
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+      - uses: actions/configure-pages@v5
 
-      - name: Compute image name
-        id: meta
-        run: |
-          echo "image=ghcr.io/$(echo '${{ github.repository }}' | tr '[:upper:]' '[:lower:]')-website" >> "$GITHUB_OUTPUT"
-
-      - name: Build and push
-        uses: docker/build-push-action@v6
+      - uses: actions/upload-pages-artifact@v3
         with:
-          context: .
-          file: website/Dockerfile
-          push: true
-          platforms: linux/amd64,linux/arm64
-          tags: |
-            ${{ steps.meta.outputs.image }}:latest
-            ${{ steps.meta.outputs.image }}:${{ github.sha }}
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
-
-  deploy:
-    needs: build-and-push
-    runs-on: ubuntu-latest
-    environment: production
-
-    steps:
-      - name: Install Scaleway CLI
-        run: |
-          curl -fsSL https://raw.githubusercontent.com/scaleway/scaleway-cli/master/scripts/get.sh | sh
+          path: website/public
 
-      - name: Deploy to Scaleway Serverless Container
-        run: |
-          scw container container update ${{ secrets.SCW_CONTAINER_ID }} \
-            registry-image=${{ needs.build-and-push.outputs.image }}:${{ github.sha }} \
-            region=${{ env.SCW_DEFAULT_REGION }} \
-            redeploy=true
-        env:
-          SCW_ACCESS_KEY: ${{ secrets.SCW_ACCESS_KEY }}
-          SCW_SECRET_KEY: ${{ secrets.SCW_SECRET_KEY }}
-          SCW_DEFAULT_ORGANIZATION_ID: ${{ secrets.SCW_ORGANIZATION_ID }}
-          SCW_DEFAULT_PROJECT_ID: ${{ secrets.SCW_PROJECT_ID }}
+      - uses: actions/deploy-pages@v4
+        id: deployment

package/CHANGELOG.md

@@ -1,5 +1,42 @@
 # @slashgear/gdpr-cookie-scanner
 
+## 3.8.2
+
+### Patch Changes
+
+- 70d5692: chore: switch Docker runtime base to oven/bun:slim
+
+  Replaces `node:24-slim` (~200 MB) with `oven/bun:slim` (~90 MB) as the runtime stage base image, saving ~110 MB. The build stage keeps `node:24-slim` (needed for `tsc`). Playwright's `chromium-headless-shell` and its system dependencies are installed normally via `--with-deps` in the runtime stage. Verified locally: `docker run --rm gdpr-bun-test --help` works correctly.
+
+- a8cb2b6: Switch Playwright browser from `chromium` to `chromium-headless-shell` in Docker and CI.
+
+  The headless-shell binary is a stripped-down Chromium build without UI layers, reducing the Docker image size by ~150–200 MB. All scanner features (cookie capture, network interception, DOM interaction, screenshots, bounding boxes) are fully supported. The scanner already runs in headless mode exclusively.
+
+## 3.8.1
+
+### Patch Changes
+
+- 3204616: Fix cookie capture after accept/reject on sites with non-unique button CSS classes
+
+  Two bugs prevented cookies from being captured after interacting with the consent modal:
+
+  1. **Non-unique button selector** — on sites built with a design system (e.g. Scaleway), all CMP buttons share identical CSS classes. The generated selector matched multiple elements and Playwright resolved to the first one, which was often hidden. The selector generator now checks that the class-based selector is unique in the DOM; if not, it falls back to Playwright's `:has-text()` pseudo-selector so each button is targeted individually.
+
+  2. **Page navigation not awaited** — some CMPs trigger a full page reload when the user accepts or rejects. The scanner was capturing cookies after a fixed delay, before the server had time to set them via `Set-Cookie`. The delay is now replaced by `waitForLoadState("networkidle")` so cookies are captured once the page (and any post-navigation requests) has settled.
+
+- 032376e: Fix false non-compliance indicators for sites using only consent-exempt analytics (Plausible, Fathom, etc.)
+
+  Sites that use privacy-respecting, cookieless analytics tools (exempt under the CNIL exemption) and have no consent banner should score 100 with no non-compliance flags. Two bugs in the HTML report were causing the opposite:
+
+  1. The HTML network section was showing a red "before consent" badge for all trackers fired before interaction, regardless of whether they require consent — Plausible was being flagged as a violation even though it is explicitly marked `consentRequired: false`.
+  2. The HTML checklist "No tracker before consent" rule was not filtering by `requiresConsent`, so it displayed ❌ Non-compliant for sites that only use Plausible.
+
+  Fixes:
+
+  - HTML network section: consent-exempt trackers fired before interaction now show a green "exempt" badge instead of the red "before consent" badge. The header count badge only counts consent-requiring trackers.
+  - HTML checklist: "No tracker before consent" now correctly filters by `requiresConsent`.
+  - Markdown network section: added a "Consent req." column so readers can immediately see which trackers require consent and which are exempt.
+
 ## 3.8.0
 
 ### Minor Changes

package/CONTRIBUTING.md

@@ -4,7 +4,7 @@
 
 - Node.js ≥ 24
 - pnpm
-- Playwright: `pnpm exec playwright install chromium`
+- Playwright: `pnpm exec playwright install chromium-headless-shell`
 
 ## Repository structure
 

package/Dockerfile

@@ -1,37 +1,35 @@
 # ── Stage 1: build ────────────────────────────────────────────────────────────
+# node:24-slim is kept here because tsc (TypeScript compiler) requires Node.js
 FROM node:24-slim AS builder
 WORKDIR /app
 
-RUN npm install -g pnpm@latest
+RUN npm install -g bun
 
-COPY package.json pnpm-lock.yaml ./
-RUN pnpm install --frozen-lockfile
+COPY package.json bun.lock ./
+RUN bun install --frozen-lockfile
 
 COPY tsconfig.json ./
 COPY scripts ./scripts
 COPY src ./src
-RUN pnpm build
+RUN bun run build
 
 # ── Stage 2: runtime ──────────────────────────────────────────────────────────
-# node:24-slim + Chromium only (~400-600 MB) vs the full Playwright image
-# (~1.5-1.8 GB with all 3 browser stacks).
-FROM node:24-slim
+# oven/bun:slim (~90 MB) vs node:24-slim (~200 MB) — saves ~110 MB.
+# Playwright runs fine under Bun (verified by e2e test suite).
+FROM oven/bun:slim
 WORKDIR /app
 ENV NODE_ENV=production
 
-RUN npm install -g pnpm@latest
+COPY package.json bun.lock ./
+RUN bun install --production --frozen-lockfile
 
-# Install production dependencies first — playwright CLI is needed for browser install
-COPY package.json pnpm-lock.yaml ./
-RUN pnpm install --prod --frozen-lockfile
-
-# Install Chromium + its system dependencies, then clean up apt caches
-RUN pnpm exec playwright install chromium --with-deps \
+# --with-deps installs Chromium system libraries via apt (safe in Docker, unlike CI runners)
+RUN bunx playwright install chromium-headless-shell --with-deps \
     && rm -rf /var/lib/apt/lists/*
 
 COPY --from=builder /app/dist ./dist
 
 VOLUME ["/reports"]
 
-ENTRYPOINT ["node", "dist/cli.js"]
-CMD ["--help"]
+ENTRYPOINT ["bun", "dist/cli.js"]
+CMD ["--help"]

package/README.md

@@ -25,7 +25,7 @@ Manually verifying that a consent banner behaves correctly — no cookies droppe
 
 ```bash
 npm install -g @slashgear/gdpr-cookie-scanner
-npx playwright install chromium
+npx playwright install chromium-headless-shell
 ```
 
 Or run without installing:
@@ -33,7 +33,7 @@ Or run without installing:
 ```bash
 npx @slashgear/gdpr-cookie-scanner scan https://example.com
 # Playwright is still required the first time:
-npx playwright install chromium
+npx playwright install chromium-headless-shell
 ```
 
 ## Docker
@@ -221,7 +221,7 @@ The package can be used as a Node.js library — no CLI required.
 
 ```bash
 npm install @slashgear/gdpr-cookie-scanner
-npx playwright install chromium
+npx playwright install chromium-headless-shell
 ```
 
 ### Quick scan