chore(core): auto-update vendored lockdown.umd.js #1078
Conversation
This changes the `lint-staged` configuration so that when `package-lock.json` is updated, the vendored `packages/core/lib/lockdown.umd.js` is copied from the currently-installed `ses` and added to the commit. I'm not sure if this is something we want to be doing or not, but needing to run the `lib:ses` script in `lavamoat-core` after a `ses` upgrade is non-obvious for maintainers (me).
github-actions
bot
added
dependencies
| @@ -29,7 +29,7 @@ | |||
| "!*.tsbuildinfo" | |||
| ], | |||
| "scripts": { | |||
| "lib:ses": "cp ../../node_modules/ses/dist/lockdown.umd.js ./lib/lockdown.umd.js", | |||
| "lib:ses": "cp ../../node_modules/ses/dist/lockdown.umd.js ./lib/lockdown.umd.js && git add -A ./lib/lockdown.umd.js", | |||
There was a problem hiding this comment.
| "lib:ses": "cp ../../node_modules/ses/dist/lockdown.umd.js ./lib/lockdown.umd.js && git add -A ./lib/lockdown.umd.js", | |
| "lib:ses": "cp ../../node_modules/ses/dist/lockdown.umd.js ./lib/lockdown.umd.js", |
I think the package scripts like this shouldn't be modifying the local git environment, any drawback to moving it into the lint-script?
There was a problem hiding this comment.
sure (I had it this way originally but changed it for reasons that escape me)
| // @ts-check | ||
|
|
||
| /** @type {import('lint-staged').Config} */ | ||
| module.exports = { | ||
| '*.js': ['eslint --fix', 'prettier --write'], | ||
| '*.(ts|md|ya?ml|json)': ['prettier --write'], | ||
| '!((package-lock|policy)*).json': ['prettier --write'], | ||
| 'package-lock.json': () => ['npm run -w lavamoat-core lib:ses'], |
There was a problem hiding this comment.
| 'package-lock.json': () => ['npm run -w lavamoat-core lib:ses'], | |
| 'package-lock.json': () => ['npm run -w lavamoat-core lib:ses && git add -A ./packages/core/lib/lockdown.umd.js'], |
There was a problem hiding this comment.
I think the package scripts like this shouldn't be modifying the local git environment, any drawback to moving it into the lint-script?
|
IMO a more proper solution would be to not have a copy checked into git at all - just vendor a copy from the package Other than or until that, maybe giving a more helpful error message to the failing test here would also solve most of the need here, without additional magic in commit hooks? |
|
Yeah, I mean, why do we vendor |
|
Closing in lieu of a PR which removes it |
This changes the
lint-stagedconfiguration so that whenpackage-lock.jsonis updated, the vendoredpackages/core/lib/lockdown.umd.jsis copied from the currently-installedsesand added to the commit.I'm not sure if this is something we want to be doing or not, but needing to run the
lib:sesscript inlavamoat-coreafter asesupgrade is non-obvious for maintainers (me).