Repository navigation
Fix Yarn installs immediately after erxes package releases - #11
Conversation
Reviewer's GuideThe PR fixes fresh Yarn installs after erxes releases by sharing release metadata between dependency generation and Yarn configuration, preapproving only the exact first-party versions selected by each scaffold, and adding an end-to-end quarantine test that confirms unrelated dependency age gating remains enforced. File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
|
Important
This repository does not receive automatic reviews because it has fewer than 10 stars. ⚙️ Run configuration
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hey - I've found 1 issue
Prompt for AI Agents
Please address the comments from this code review:
## Individual Comments
### Comment 1
<location path="src/generated.ts" line_range="189" />
<code_context>
+ // These exact first-party releases are selected by the scaffold.
+ // Allow installing immediately after publication while preserving
+ // Yarn's age gate for all other packages and versions.
+ npmPreapprovedPackages: [
+ ERXES_PACKAGES["erxes-ui"].slice(4),
+ ERXES_PACKAGES["ui-modules"].slice(4),
</code_context>
<issue_to_address>
**Installs stop on older Yarn**
When a project is generated with a Yarn version that predates `npmPreapprovedPackages`, the scaffold emits `npmPreapprovedPackages` without guarding against that Yarn version, so Yarn rejects the setting during configuration loading and installation stops before resolving packages.
Only emit this setting for supported Yarn versions, or enforce a minimum Yarn version before scaffolding.
</issue_to_address>Sourcery assessment
Needs a human reviewer. 1 finding to address first, and newly generated Yarn projects will bypass the age quarantine for the listed exact erxes package releases, so a compromised or otherwise unsafe release could execute during installation before the gate would normally allow it. Reverting stops future scaffolds from adding the exception, but cannot undo installs or any secrets exposed by affected projects.
Blocking findings: src/generated.ts:189
| // These exact first-party releases are selected by the scaffold. | ||
| // Allow installing immediately after publication while preserving | ||
| // Yarn's age gate for all other packages and versions. | ||
| npmPreapprovedPackages: [ |
There was a problem hiding this comment.
🟡 Medium · Installs stop on older Yarn
When a project is generated with a Yarn version that predates npmPreapprovedPackages, the scaffold emits npmPreapprovedPackages without guarding against that Yarn version, so Yarn rejects the setting during configuration loading and installation stops before resolving packages.
Only emit this setting for supported Yarn versions, or enforce a minimum Yarn version before scaffolding.
Prompt for AI agents
In `src/generated.ts` at line 189:
**Installs stop on older Yarn**
When a project is generated with a Yarn version that predates `npmPreapprovedPackages`, the scaffold emits `npmPreapprovedPackages` without guarding against that Yarn version, so Yarn rejects the setting during configuration loading and installation stops before resolving packages.
Only emit this setting for supported Yarn versions, or enforce a minimum Yarn version before scaffolding.
Yarn 4.18.1 quarantines npm releases for 24 hours, so the generated project could not install the newly published
@erxes/*@3.3.4packages. Preapprove only the exact first-party versions selected by the scaffold, keeping the age gate for other versions and dependencies.Share the release constants between dependency generation and Yarn approvals. The Yarn end-to-end test forces the erxes packages into quarantine, verifies installation fails without approvals, then installs, checks and builds with the generated approvals.
Verified: 54 unit tests, typecheck, lint, Linux binary compilation, and the packed CLI platform/Yarn end-to-end test with
CI=true.Summary by Sourcery
Allow generated projects to install newly published erxes packages without disabling Yarn's dependency age gate.
Bug Fixes:
Enhancements:
Tests: