Draft: Select Vite or Rspack for Caproni edit mode with GITLAB_BUNDLER

What does this MR do and why?

Lets Caproni edit mode run the Rspack dev server instead of Vite, selected with GITLAB_BUNDLER=rspack (default stays vite). GDK made Rspack the default bundler in gitlab-development-kit!6068 (merged); this brings Caproni in line, as asked in caproni#270.

The Caproni-side wiring moves out of caproni-project.yaml into .gitlab/caproni/{bundler,dev-server,puma}.sh, and setup.sh writes the webpack.dev_server block into the copied gitlab.yml when Rspack is selected. Caproni rejects ${VAR:-default} in config values, so an env var read by the scripts is the switch.

Rspack needs one Rails-side addition that Vite does not: in Caproni the workhorse runs in the cluster in production mode and answers /assets misses itself, so page-relative asset URLs never reach Rails. Vite only works because vite-ruby emits absolute 127.0.0.1:3036 URLs. A new webpack.dev_server.public_url setting makes the dev server the asset_host in development; the Rspack dev server uses it as publicPath and lazy-compilation serverUrl, sends CORS headers, and proxies non-bundle /assets requests (Sprockets CSS, fonts, images) back to Puma via DEV_SERVER_PROXY_TARGET. The CSP allows the origin. Unset, nothing changes: bundles keep going through Gitlab::Webpack::DevServerMiddleware as in GDK.

Known gap, pre-existing and identical in Vite mode: the same-origin SVG icon sprite still 404s through the in-cluster workhorse, since the webservice container ships no compiled assets.

References

• caproni#270
• gitlab-development-kit!6068 (merged)
• #604385
• gitlab-caproni#22

How to set up and validate locally

1. In a Caproni rig with repositories.gitlab.edit_mode: true, export GITLAB_BUNDLER=rspack (for example in the rig's mise.local.toml [env]; note that mise's env overrides an inline variable when caproni is a mise shim) and run caproni run.
2. Open the GitLab host in Chrome: bundles, CSS, fonts and lazy chunks load from http://127.0.0.1:3808, HMR hot-update.json requests appear on edits, and the performance bar (a lazily compiled chunk) renders.
3. Switch back with GITLAB_BUNDLER=vite and restart: config/gitlab.yml has a bare webpack: key again and assets come from 127.0.0.1:3036.
4. bin/rspec spec/initializers/rails_asset_host_spec.rb spec/lib/gitlab/content_security_policy/config_loader_spec.rb

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.