verify-action-build: recognise aube-lock.yaml as a node lock file - #1175
Open
potiuk wants to merge 1 commit into
Open
verify-action-build: recognise aube-lock.yaml as a node lock file#1175potiuk wants to merge 1 commit into
potiuk wants to merge 1 commit into
Conversation
jdx/mise-action v4.2.4 moved its build to aube (jdx/aube), which writes aube-lock.yaml in pnpm's lockfileVersion 9 format -- resolved versions plus sha512 integrity for all 460 transitive deps, the same guarantee the other node lock files give. The presence check only knew the five established filenames, so #1167 hard-failed with "no matching lock file" on a repo that has one. Also teaches the rebuild to install from it (pnpm reads the file once renamed; --no-frozen-lockfile is required because aube records an undeclared direct tslib dep that trips pnpm's manifest check). Without that branch the rebuild silently fell through to an unpinned npm install. Generated-by: Claude Code (Opus 5)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Code change
Summary
jdx/mise-actionv4.2.4 moved its build to aube, which writesaube-lock.yamlinstead ofpackage-lock.json. The file is pnpm's lockfileVersion 9 format and carries resolved versions plus sha512 integrity for all 460 transitive deps, so the pinning guarantee is the same one the other node lock files give. The presence check only knew the five established filenames, so #1167 hard-failed with "no matching lock file" on a repo that has one.aube-lock.yamlin the lock-file presence check and the dependency-pinning note (security.py), and exclude it from the source diff as a generated lock file (diff_source.py).--no-frozen-lockfileis required because aube records an undeclared directtslibdep that trips pnpm's manifest check. Without this branch the rebuild silently fell through to an unpinnednpm install.Type of change
Testing
uv run pytest utils/tests/- 330 passed, including a new lock-file-presence case foraube-lock.yaml.analyze_lock_files('jdx', 'mise-action', '7e36c90d9ab29c415a2384db3006f3ec8a8cc654')now reportsnode: package.json -> aube-lock.yamlwith no errors.aube-lock.yamlin anode:24-slimcontainer: it validates all 460 entries and installs the lockfile-pinned versions.Drafted-by: Claude Code (Opus 5); reviewed by @potiuk before posting