Skip to content

fix(discovery): skip deleted npm packages #163

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
hopehadfield wants to merge 1 commit into from
Closed

fix(discovery): skip deleted npm packages #163

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 15 additions & 0 deletions .github/workflows/update-plugins-repo-refs.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -200,6 +200,10 @@ jobs:
npmPackages=()
declare -A packageToWorkspace=()
declare -A packageToDirectory=()
# Workspaces successfully scanned from their current source refs.
# npm discovery can still return packages that were removed or renamed
# in those refs, so use this to reject unmapped packages later.
declare -A overlayWorkspaceScanned=()

# ===== Overlay-first package discovery =====
# Enumerate existing workspaces from the overlay repo and discover
Expand Down Expand Up @@ -237,6 +241,7 @@ jobs:
return 1
fi

overlayWorkspaceScanned["$wsName"]="true"

@gashcrumb gashcrumb Sep 11, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If source.json or the tree scan cannot be read, enumerateOverlayWorkspace returns failure but both callers continue. This assignment is then skipped, so npm-discovered packages bypass the new validation and can be written. Propagate the failure or fail the workspace update rather than continuing unvalidated.

@gashcrumb gashcrumb Sep 11, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The package-to-workspace map is global, but it is populated from one arbitrary overlay branch and reused for every branch. Because branches can have different source.json refs, a package valid at the chosen branch ref can be emitted for another branch where it is absent. Keep this mapping scoped to its overlay branch and source ref.

local count=0
while IFS= read -r line; do
[[ -z "$line" ]] && continue
Expand Down Expand Up @@ -407,6 +412,16 @@ jobs:
pluginInfo=$(echo "${pluginInfo}" | jq --arg dir "${treeDirectory}" '.directory = $dir')
fi
fi

# A package can remain published in NPM after it has been removed
# or renamed in the source repository. If its workspace was scanned
# successfully at the current source ref but the package was not
# found there, do not reintroduce its stale repository.directory.
if [[ -n "${workspace}" && -n "${overlayWorkspaceScanned[${workspace}]+x}" && -z "${packageToWorkspace[${packageName}]+x}" ]]; then

@gashcrumb gashcrumb Sep 11, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The source tree scan is performed at sourceRef from the existing overlay source.json, but the update later selects workspaceCommit from npm package gitHeads. A package that exists at the old ref but was removed at workspaceCommit remains mapped and bypasses this guard; a package added after the old ref is dropped. Validate membership against the selected workspace commit before preparing the plugin list.

message " Skipping published plugin ${packageName}@${version}: package directory is not present at the current source ref for workspace ${workspace}"
continue
fi

if [[ "${INPUT_WORKSPACE_PATH}" != "" && "${INPUT_WORKSPACE_PATH}" != "workspaces/${workspace}" ]]
then
message " Skipping published plugin ${packageName}: not part of workspace ${INPUT_WORKSPACE_PATH}"
Expand Down