Modernize dashboard dependencies and build workflows

.github/dependabot.yml

@@ -0,0 +1,21 @@
+version: 2
+updates:
+  - package-ecosystem: npm
+    directory: /dashboard
+    schedule:
+      interval: monthly
+    groups:
+      react:
+        patterns: [react, react-dom, '@types/react*']
+      material-ui:
+        patterns: ['@mui/*', '@emotion/*']
+      tooling:
+        dependency-type: development
+        exclude-patterns: ['@types/react*']
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: monthly
+    groups:
+      actions:
+        patterns: ['*']

.github/workflows/dashboard-ci.yml

@@ -0,0 +1,52 @@
+name: Dashboard CI
+
+on:
+  pull_request:
+    paths:
+      - 'dashboard/**'
+      - '.github/workflows/**'
+  push:
+    branches: [main, streamlit]
+    paths:
+      - 'dashboard/**'
+      - '.github/workflows/**'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: dashboard-ci-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  checks:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    defaults:
+      run:
+        working-directory: dashboard
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version-file: dashboard/.nvmrc
+          cache: npm
+          cache-dependency-path: dashboard/package-lock.json
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version-file: dashboard/.python-version
+          cache: pip
+          cache-dependency-path: dashboard/requirements-deploy.txt
+      - run: python -m pip install --require-hashes -r requirements-deploy.txt
+      - run: python -m unittest discover -s tests -p 'test_*.py'
+      - run: npm ci
+      - run: npm run check
+      - name: Prepare build fixtures (no MinIO credentials)
+        run: node scripts/prepare-ci-data.mjs
+      - name: Build for GitHub Pages
+        env:
+          BASE_PATH: /slcomp/
+        run: npm run build
+      - name: Verify build artifacts
+        run: node scripts/check-build.mjs

.github/workflows/deploy.yml

@@ -2,80 +2,72 @@ name: Deploy React Dashboard to GitHub Pages
 
 on:
   push:
-    paths: [ 'dashboard/**' ]
+    branches: [main, streamlit]
+    paths:
+      - 'dashboard/**'
+      - '.github/workflows/deploy.yml'
   workflow_dispatch:
 
 permissions:
   contents: read
-  pages: write
-  id-token: write
 
 concurrency:
-  group: "pages"
+  group: pages
   cancel-in-progress: false
 
 jobs:
   build:
-    runs-on: ubuntu-latest
+    if: github.ref == 'refs/heads/main' || github.ref == 'refs/heads/streamlit'
+    runs-on: ubuntu-24.04
+    timeout-minutes: 20
+    defaults:
+      run:
+        working-directory: dashboard
     steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Setup Python
-        uses: actions/setup-python@v5
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          python-version: '3.12'
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
+          node-version-file: dashboard/.nvmrc
+          cache: npm
+          cache-dependency-path: dashboard/package-lock.json
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
-          node-version: '20'
-          cache: 'npm'
-          cache-dependency-path: 'dashboard/package-lock.json'
-
-      - name: Install Python dependencies
-        run: |
-          cd dashboard
-          pip install pandas numpy minio pyarrow fastparquet
-
+          python-version-file: dashboard/.python-version
+          cache: pip
+          cache-dependency-path: dashboard/requirements-deploy.txt
+      - run: python -m pip install --require-hashes -r requirements-deploy.txt
+      - run: python -m unittest discover -s tests -p 'test_*.py'
+      - run: npm ci
+      - run: npm run check
       - name: Prepare data from MinIO
         env:
           MINIO_ENDPOINT_URL: ${{ secrets.MINIO_ENDPOINT_URL }}
           MINIO_ACCESS_KEY: ${{ secrets.MINIO_ACCESS_KEY }}
           MINIO_SECRET_KEY: ${{ secrets.MINIO_SECRET_KEY }}
-        run: |
-          cd dashboard
-          python prepare_data.py
-
-      - name: Install dependencies
-        run: |
-          cd dashboard
-          npm ci
-
-      - name: Setup Pages
-        uses: actions/configure-pages@v4
-
-      - name: Build
+        run: python prepare_data.py
+      - name: Build for GitHub Pages
         env:
           BASE_PATH: /slcomp/
           VITE_MINIO_ENDPOINT: ${{ secrets.VITE_MINIO_ENDPOINT }}
-        run: |
-          cd dashboard
-          npm run build
-
-      - name: Upload artifact
-        uses: actions/upload-pages-artifact@v3
+        run: npm run build
+      - name: Verify build artifacts
+        run: node scripts/check-build.mjs
+      - uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
         with:
-          path: 'dashboard/dist'
+          path: dashboard/dist
 
   deploy:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    needs: build
+    permissions:
+      pages: write
+      id-token: write
     environment:
       name: github-pages
       url: ${{ steps.deployment.outputs.page_url }}
-    runs-on: ubuntu-latest
-    needs: build
-    if: github.ref == 'refs/heads/main' || github.ref == 'refs/heads/streamlit'
     steps:
+      - uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@v4
+        uses: actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346 # v5.0.1

dashboard/.nvmrc

@@ -0,0 +1 @@
+24

dashboard/.python-version

@@ -0,0 +1 @@
+3.14

dashboard/PERFORMANCE.md

@@ -50,8 +50,27 @@ Validation included:
   of the external MinIO/zrok service was not inferred from those tests.
 - Real-time animation checks: 30 frames/s for a visible map, 0 frames/s for a
   fully offscreen map.
-- `npm test`, TypeScript/Vite build and lint (no errors; 8 existing `any` warnings).
+- At the time of the original performance review: `npm test`, TypeScript/Vite
+  build and lint (no errors; 8 existing `any` warnings).
 
 The exporter regression tests run with `npm test`; `npm run build` regenerates
 browser data from the local source JSON automatically. Deployment still obtains
 those sources through `prepare_data.py` before building.
+
+## Build modernization verification
+
+Also checked on 2026-10-03 after upgrading React 19, Material UI 9, Vite 8,
+ESLint 10 and TypeScript 6 on Node 24. A clean `npm ci` succeeds and
+`npm run check` now reports zero lint warnings. The production bundle built
+in 1.89 seconds in one local run; this is a build observation, not a browser
+performance benchmark. Its entry chunk is 462 KB (141 KB gzip); map, tables,
+cutouts and observatory dialog remain separate lazy chunks.
+
+Repeated production browser checks passed for desktop/mobile layers, the hidden
+photo, image cache/URL cleanup and bitmap reuse. Keyboard slider changes,
+filter reset, search and Enter selection were also exercised. The visible pulse remains at
+30 frames/s and stops fully offscreen. The isolated CI fixture build also passed
+Pages path, 256-shard, WebP and source-dataset omission checks. The earlier heap
+and main-thread measurements above were not remeasured for this dependency
+upgrade. The Python 3.14/pandas 3 exporter passes its CSV/Parquet integration test
+without MinIO access.

dashboard/README.md

@@ -8,9 +8,17 @@ Interactive dashboard for exploring astronomical lens data.
 * Data & consolidated parameter tables
 * Image cutout gallery
 
+## Requirements
+
+The dashboard uses Node 24 LTS/npm 11, React 19, Material UI 9 and Vite 8.
+The MinIO exporter uses Python 3.14, pandas 3 and PyArrow. TypeScript stays
+on version 6 because the ESLint integration currently supports versions below
+6.1; see [typescript-eslint compatibility](https://typescript-eslint.io/users/dependency-versions/).
+
 ## Quick Start
 ```bash
-npm install
+nvm use          # Node 24 LTS, npm 11
+npm ci
 npm run dev      # http://localhost:5173
 ```
 
@@ -38,7 +46,9 @@ Edit `src/theme.ts` (palette, breakpoints, shadows, transitions).
 ```bash
 npm run dev    # Start dev server
 npm run build  # Production bundle
-npm run lint   # ESLint
+npm run lint   # ESLint, including scripts/configuration; zero warnings
+npm run typecheck # TypeScript source and Vite configuration
+npm run check  # Lint, typecheck and export regression tests
 npm test       # Export/provenance regression tests
 ```
 
@@ -51,12 +61,41 @@ export BASE_PATH=/slcomp/
 npm run build
 ```
 
-Then publish the contents of `dist/` to the `gh-pages` branch (or use an action). The data loader code uses `import.meta.env.BASE_URL` to construct paths like `<BASE_URL>data/database.json`, avoiding the common `Unexpected token '<'` JSON parse error that happens when a 404 HTML page is fetched instead of the JSON file.
+`.github/workflows/dashboard-ci.yml` checks pull requests with deterministic
+example data, without MinIO credentials. It runs the Python export test, lint, type checking, JavaScript regression
+tests, the production build and artifact checks (Pages paths, all 256 detail
+shards, WebP assets and omission of redundant source catalogs).
+
+`.github/workflows/deploy.yml` exports real data from MinIO and publishes the
+Pages artifact after a push to `main` or `streamlit`, or a manual run on either
+branch. Both workflows use Ubuntu 24.04, Node 24, dependency caches and Actions
+pinned to release commit hashes. Deployment permissions belong to the deploy
+job. Dependabot checks npm dependencies and Actions monthly.
+
+Install the reproducible exporter environment with:
+
+```bash
+python3.14 -m venv .venv
+.venv/bin/python -m pip install --require-hashes -r requirements-deploy.txt
+.venv/bin/python -m unittest discover -s tests -p 'test_*.py'
+# Export real data with MINIO_ENDPOINT_URL, MINIO_ACCESS_KEY and MINIO_SECRET_KEY:
+.venv/bin/python prepare_data.py
+```
+
+To refresh the Python lock after editing `requirements-deploy.in`, from the
+repository root:
+
+```bash
+uv pip compile dashboard/requirements-deploy.in --python-version 3.14 \
+  --generate-hashes -o dashboard/requirements-deploy.txt
+```
 
-If you see that error after deployment, confirm:
-1. The JSON files exist in `dist/data/` (they are copied from `public/data/`).
-2. `BASE_PATH` matched the repository subpath and ends with a trailing slash.
-3. Browser network panel requests resolve to `200` and not `404`/`301`.
+The fixture generator (`node scripts/prepare-ci-data.mjs`) overwrites
+`public/data/` and is intended for a disposable checkout. Keep real local data
+when building outside CI. After a Pages build, run
+`node scripts/check-build.mjs` to validate the artifact. The browser loads
+`<BASE_URL>data/catalog.json` and object shards; ensure `BASE_PATH` includes the
+repository subpath and trailing slash when publishing.
 
 
 ## Sky coverage layers

dashboard/eslint.config.js

@@ -1,28 +1,30 @@
-export default [
+import js from '@eslint/js';
+import { defineConfig, globalIgnores } from 'eslint/config';
+import globals from 'globals';
+import tseslint from 'typescript-eslint';
+import reactHooks from 'eslint-plugin-react-hooks';
+import reactRefresh from 'eslint-plugin-react-refresh';
+
+export default defineConfig([
+  globalIgnores(['dist/**', 'node_modules/**', 'public/**', '.cache/**']),
   {
-    ignores: ['dist/', 'node_modules/', '*.config.js'],
+    files: ['**/*.{js,mjs}'],
+    extends: [js.configs.recommended],
+    languageOptions: { globals: { ...globals.node, ...globals.browser } },
+  },
+  {
+    files: ['src/**/*.{ts,tsx}', 'vite.config.ts'],
+    extends: [js.configs.recommended, tseslint.configs.recommended],
+    languageOptions: { globals: { ...globals.browser, ...globals.node } },
+    rules: { '@typescript-eslint/no-unused-vars': ['error', { argsIgnorePattern: '^_' }] },
   },
   {
     files: ['src/**/*.{ts,tsx}'],
-    languageOptions: {
-      ecmaVersion: 'latest',
-      sourceType: 'module',
-      parser: await import('@typescript-eslint/parser').then(m => m.default),
-      parserOptions: {
-        ecmaFeatures: { jsx: true },
-      },
-    },
-    plugins: {
-      '@typescript-eslint': await import('@typescript-eslint/eslint-plugin').then(m => m.default),
-      'react-hooks': await import('eslint-plugin-react-hooks').then(m => m.default),
-      'react-refresh': await import('eslint-plugin-react-refresh').then(m => m.default),
-    },
+    plugins: { 'react-hooks': reactHooks, 'react-refresh': reactRefresh },
     rules: {
-      '@typescript-eslint/no-unused-vars': ['error', { argsIgnorePattern: '^_' }],
-      '@typescript-eslint/no-explicit-any': 'warn',
       'react-hooks/rules-of-hooks': 'error',
-      'react-hooks/exhaustive-deps': 'warn',
-      'react-refresh/only-export-components': ['warn', { allowConstantExport: true }],
+      'react-hooks/exhaustive-deps': 'error',
+      'react-refresh/only-export-components': ['error', { allowConstantExport: true }],
     },
   },
-];
+]);