You're Invited:Meet the Socket Team at RSAC and BSidesSF 2026, March 23–26.RSVP
Socket
Book a DemoSign in
Socket

metafile-codecov-bundle

Package Overview
Dependencies
Maintainers
1
Versions
2
Alerts
File Explorer

Advanced tools

Socket logo

Install Socket

Detect and block malicious and high-risk dependencies

Install

metafile-codecov-bundle

Convert bun or esbuild metafile output to Codecov bundle analysis format

latest
Source
npmnpm
Version
0.1.1
Version published
Maintainers
1
Created
Source

metafile-codecov-bundle

Convert bun or esbuild metafile output to Codecov bundle analysis format.

Both bun and esbuild produce an identical metafile JSON format describing the build. This package transforms that into Codecov's v3 bundle analysis payload and can upload it directly using GitHub Actions OIDC.

Installation

bun add -d metafile-codecov-bundle
# or
npm install -D metafile-codecov-bundle

CLI usage

Generate a metafile during your build, then convert it:

# bun
bun build --outdir=dist --metafile=metafile.json ./src/index.ts
metafile-codecov -f metafile.json -n my-app --bundler-name bun --bundler-version 1.2.0

# esbuild
esbuild src/index.ts --bundle --outdir=dist --metafile=metafile.json
metafile-codecov -f metafile.json -n my-app --bundler-name esbuild --bundler-version 0.24.0

The Codecov JSON is written to stdout. To write to a file instead:

metafile-codecov -f metafile.json -n my-app -o codecov-bundle-stats.json

Options

FlagShortDescription
--metafile <path>-fPath to metafile JSON (required)
--bundle-name <name>-nBundle name for Codecov (required)
--output-dir <dir>Build output directory for gzip size calculation
--bundler-name <name>Bundler name (default: bun)
--bundler-version <v>Bundler version
--output <path>-oWrite output to file instead of stdout
--uploadUpload bundle stats to Codecov (GitHub Actions OIDC)
--help-hShow help
--version-vShow version

When --output-dir is provided, gzip sizes are computed by reading the actual output files from disk. Without it, gzipSize will be null.

Programmatic API

import { readFileSync, writeFileSync } from "node:fs";
import { transformMetafile } from "metafile-codecov-bundle";

const metafile = JSON.parse(readFileSync("metafile.json", "utf-8"));
const payload = transformMetafile(metafile, {
	bundleName: "my-app",
	outputDir: "dist",
	bundler: { name: "bun", version: "1.2.0" },
});

writeFileSync("codecov-bundle-stats.json", JSON.stringify(payload));

transformMetafile(metafile, options)

Transforms a bun/esbuild metafile into a Codecov OutputPayload.

The metafile parameter accepts the Metafile type exported by this package. It is also compatible with esbuild's Metafile type from the esbuild package.

OptionTypeDescription
bundleNamestringName for this bundle in Codecov (required)
outputDirstringDirectory containing build output files for gzip calculation
bundler{ name: string; version: string }Bundler metadata
builtAtnumberUnix timestamp in ms (defaults to Date.now())
durationnumberBuild duration in ms

Upload to Codecov

Built-in upload (OIDC)

The --upload flag uploads bundle stats directly to Codecov using GitHub Actions OIDC authentication. No token required — the workflow must have id-token: write permission.

permissions:
  id-token: write

steps:
  - name: Build
    run: bun build --outdir=dist --metafile=metafile.json ./src/index.ts

  - name: Upload bundle stats
    run: bunx metafile-codecov-bundle -f metafile.json -n my-app --upload

Programmatic upload

import { fetchOidcToken, getServiceParams, uploadBundleStats } from "metafile-codecov-bundle";

const result = await uploadBundleStats({
	payload: JSON.stringify(codecovPayload),
	oidcToken: await fetchOidcToken(),
	serviceParams: getServiceParams(),
});

How it works

The metafile contains inputs (source modules) and outputs (bundled files). These map to Codecov's payload as follows:

MetafileCodecovMapping
outputsassetsFile name, byte size, gzip size, hash-normalized name
outputschunksEntry detection, dynamic imports, file associations
inputsmodulesModule path, byte size, chunk membership

Source map files (.map) are excluded. Asset filenames containing 8+ hex character hashes are normalized (e.g., main-2c458a0c.js becomes main-*.js) for stable cross-build comparison.

License

MIT

Keywords

bun

FAQs

Package last updated on 09 Feb 2026

Did you know?

Socket

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Install

Related posts