Skip to content

fix(discovery): skip deleted npm packages - #163

Open
hopehadfield wants to merge 1 commit into
redhat-developer:mainfrom
hopehadfield:ignore-invalid-npm
Open

fix(discovery): skip deleted npm packages#163
hopehadfield wants to merge 1 commit into
redhat-developer:mainfrom
hopehadfield:ignore-invalid-npm

Conversation

@hopehadfield

Copy link
Copy Markdown
Member

Fixes https://redhat.atlassian.net/browse/RHIDP-16892

The overlay updater can discover packages from npm whose repository directory no longer exists at the selected source ref. Track successfully scanned workspaces and skip npm-discovered packages that are absent from the corresponding source tree.

This prevents stale packages such as dynamic-home-page from being reintroduced into plugins-list.yaml while preserving valid packages (see redhat-developer/rhdh-plugin-export-overlays#3422).

The overlay updater can discover packages from npm whose repository.directory no longer exists at the selected source ref. Track successfully scanned workspaces and skip npm-discovered packages that are absent from the corresponding source tree.\n\nThis prevents stale packages such as dynamic-home-page from being reintroduced into plugins-list.yaml while preserving valid packages.
@sonarqubecloud

Copy link
Copy Markdown

@gashcrumb

Copy link
Copy Markdown
Member

Funny, I ran into this yesterday with the rhdh-cli tests and opened this PR lemme compare this fix with that one.

# or renamed in the source repository. If its workspace was scanned
# successfully at the current source ref but the package was not
# found there, do not reintroduce its stale repository.directory.
if [[ -n "${workspace}" && -n "${overlayWorkspaceScanned[${workspace}]+x}" && -z "${packageToWorkspace[${packageName}]+x}" ]]; then

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The source tree scan is performed at sourceRef from the existing overlay source.json, but the update later selects workspaceCommit from npm package gitHeads. A package that exists at the old ref but was removed at workspaceCommit remains mapped and bypasses this guard; a package added after the old ref is dropped. Validate membership against the selected workspace commit before preparing the plugin list.

return 1
fi

overlayWorkspaceScanned["$wsName"]="true"

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If source.json or the tree scan cannot be read, enumerateOverlayWorkspace returns failure but both callers continue. This assignment is then skipped, so npm-discovered packages bypass the new validation and can be written. Propagate the failure or fail the workspace update rather than continuing unvalidated.

return 1
fi

overlayWorkspaceScanned["$wsName"]="true"

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The package-to-workspace map is global, but it is populated from one arbitrary overlay branch and reused for every branch. Because branches can have different source.json refs, a package valid at the chosen branch ref can be emitted for another branch where it is absent. Keep this mapping scoped to its overlay branch and source ref.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants