test(share): guards share card rendering against package bumps

[seferturan]

🎶 Notes 🎶

• Renders the real ShareCard through satori, so a package bump cannot silently break share images again
  • the satori 0.10 to 0.25 jump dropped every poster for six weeks and nothing caught it
  • drives the actual card through the same ImageResponse the endpoint uses, once per variant, with the existing Silo mapped mocks
  • renders to png rather than svg so resvg runs too, matching what the endpoint produces
• Changing the card does not mean updating the test
  • that was the flaw in asserting on markup shape: it only encodes what we know satori accepts today
• The assertion is that satori has nothing to complain about
  • satori reports rejected values on console.warn rather than throwing, so the spies require silence
  • failures are unwrapped to satori's own message, otherwise ImageResponse reports an unhelpful "Failed to generate SVG"
  • verified by reverting the poster size fix: it fails with Invalid value "265" for "height"
• Runs on CI only, and the test job installs fontconfig
  • satori has no default font and refuses to lay out text without one, even with every string blanked
  • the alternatives were vendoring a font, maintaining a list of font paths, or making everyone install fontconfig locally
  • ⚠️ the gate is process.env.CI, not font availability, so a runner without fontconfig fails loudly instead of quietly skipping the one test meant to catch this
• Dimensions are mocked at half scale, which takes rasterisation from 6.6s to 2.6s
  • shrinking only the canvas does not work, the card derives its own boxes from SHARE_TYPE_DIMENSIONS so the content overflows and resvg dies
  • a third scale only saves another 0.6s, fixed overhead dominates below half

🤔 Worth knowing 🤔

• The test does not run locally, so a break shows up on push rather than before it
• Renders client side and reassembles markup plus head styles, because resolve.conditions: ['browser'] stops ImageResponse taking the component directly. Closing that gap needs a separate vitest project with node conditions

[deepsource-io]

DeepSource Code Review

We reviewed changes in 010981c...ab4f1fa on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.

See full review on DeepSource ↗

PR Report Card

Overall Grade

Security   Reliability   Complexity   Hygiene   Coverage

Code Review Summary

Analyzer	Status	Updated (UTC)	Details
JavaScript		Aug 18, 2026 3:47p.m.	Review ↗
Code coverage		Aug 18, 2026 3:47p.m.	Review ↗

Code Coverage Summary

Language	Line Coverage (Overall)
Aggregate	69.2% [▲ up 0.3% from main]
Javascript	69.2% [▲ up 0.3% from main]

➟ Additional coverage metrics may have been reported. See full coverage report ↗

---

Important

AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.