From 420ba2d92b44e9c31195afe403a7b5b39f2fcfd5 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E6=9D=9C=E5=86=A0=E9=AD=81?= Date: Sun, 6 Sep 2026 09:32:39 +0900 Subject: [PATCH] revert(deps): drop the private-registry workaround for flex-fields rc.16 flex-fields 10.0.0-rc.16 is now on public npmjs - abp-modules' release workflow mirrors there only on a tag push, and rc.16 had only ever been published by workflow_dispatch, so it existed solely on GitHub Packages under @dignite-projects. Pushing the missing v10.0.0-rc.16 tag put all four packages on npmjs and removed the reason for everything below. Reverts, in this repo: - the four npm: aliases in angular/package.json (dependencies and resolutions), back to plain semver ranges - angular/.npmrc's @dignite scope mapping, and any credential in it - both workflows' job-level token env and authenticate steps - CI now needs no package credential at all - check-angular-package-duplicates.mjs's target, @dignite-projects back to @dignite - release.yml's packed-verify token argument, and its published-verify back to secrets.GITHUB_TOKEN, which 0.1.0-preview.11 shows reads abp-modules' packages fine given the "Manage Actions access" grant they carry Kept: verify-packed-npm-install.sh's optional token/overrides path, dormant and documented as such. It is the thing to reach for if a dependency is ever consumed before it reaches npmjs again, and that gate runs after the NuGet packages are already pushed live, so it failing is expensive. The deciding argument was not effort but blast radius: a private-only dependency means every contributor needs a read:packages credential just to yarn install, and CI on a fork PR cannot have one at all, since GitHub does not pass secrets to fork-triggered runs. Verified with zero credentials in the environment, an empty HOME and an empty yarn cache: yarn install --frozen-lockfile resolves all four packages from registry.yarnpkg.com at 10.0.0-rc.16. Plus the duplicate check (24 packages, one copy each), the packaged-deps check, yarn ng test site (29), build:site and the Host build. --- .github/scripts/verify-packed-npm-install.sh | 14 ++- .github/workflows/ci.yml | 40 +++---- .github/workflows/release.yml | 79 +++++--------- CHANGELOG.md | 105 ++++++++----------- angular/.npmrc | 25 ++--- angular/package.json | 12 +-- angular/yarn.lock | 24 ++--- 7 files changed, 116 insertions(+), 183 deletions(-) diff --git a/.github/scripts/verify-packed-npm-install.sh b/.github/scripts/verify-packed-npm-install.sh index 6faa0a2..d389317 100644 --- a/.github/scripts/verify-packed-npm-install.sh +++ b/.github/scripts/verify-packed-npm-install.sh @@ -34,14 +34,12 @@ # because a plain `npm install` here otherwise resolves those siblings straight from public # npmjs, which 404s for as long as a given flex-fields version is GitHub-Packages-only # (workflow_dispatch-only releases in abp-modules skip the tag-triggered step that mirrors to -# public npmjs - see CHANGELOG.md's 10.0.0-rc.16 entry). release.yml passes -# `secrets.PACKAGES_READ_TOKEN` rather than `secrets.GITHUB_TOKEN`, matching the NuGet side and -# GITHUB_TOKEN's documented "own repository only" package scoping; any token that can read -# abp-modules' packages works here. Note this mode runs `npm`, not `yarn`, so it is unaffected -# by the Yarn-Classic alias/auth trap angular/.npmrc documents - npm resolves the alias target's -# own scope. Omit the token and this mode reverts to installing every `@dignite/*` sibling from -# its plain public-npmjs name, unchanged from before this existed - the right behavior again -# once every flex-fields dependency in play is fully public. +# public npmjs - see CHANGELOG.md's 10.0.0-rc.16 entry for the one time that happened). It is +# dormant today and release.yml passes no token: flex-fields is public again, so the packed +# manifest's plain `@dignite/*` names resolve exactly as they say. Reach for it if a flex-fields +# release is ever consumed here before it reaches npmjs. Any token that can read abp-modules' +# packages works - `secrets.GITHUB_TOKEN` does, given the "Manage Actions access" grant those +# packages carry for this repository. # # published # Installs what was actually published to GitHub Packages, after the publish step. Not diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index d6eb953..b52ea4c 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -39,20 +39,10 @@ jobs: permissions: contents: read - # angular/.npmrc maps the @dignite and @dignite-projects scopes to GitHub Packages and - # references ${PACKAGES_READ_TOKEN} for it. Yarn Classic substitutes every env-var placeholder - # in its resolved config on every invocation and throws when one is unset - including the - # `yarn cache dir` probe setup-node runs for `cache: yarn`, which happens before any run: step - # of this job. So it has to be job-level, not set on the install step - exactly as release.yml - # already does. - # - # @dignite/ng.flex-fields (and its -ckeditor/-file-explorer adapters, and @dignite/ng.file- - # explorer) started resolving through those scopes as of 10.0.0-rc.16 - release.yml's copy of - # this comment carries the full account (why, the alias mechanism, and what to revert once it's - # no longer needed); angular/.npmrc carries the reason BOTH scopes have to be mapped, which is - # the non-obvious half and the one this job actually died on twice. - env: - PACKAGES_READ_TOKEN: ${{ secrets.PACKAGES_READ_TOKEN }} + # No package credential of any kind here: every @dignite/* dependency resolves from public + # npmjs, so `yarn install` below needs no authentication. This job briefly did need one, while + # flex-fields 10.0.0-rc.16 existed only on GitHub Packages; see CHANGELOG.md for that detour and + # why tagging the release in abp-modules was the better answer than carrying the workaround. steps: - name: Checkout site @@ -123,11 +113,11 @@ jobs: # # release.yml used to install with npm here, because Yarn Classic fetched a dependency whose # lockfile entry carried a GitHub Packages "resolved" URL through a code path that never - # attached registry auth. That was fixed and both workflows ran the same yarn command against - # public-npmjs-only @dignite/* packages for a while - but as of 10.0.0-rc.16, @dignite/* - # aliases back onto GitHub Packages (see the job-level env: block's comment above), so this - # repeats the original gotcha's shape if that auth ever regresses. release.yml's step carries - # the longer account. + # attached registry auth. No such entry remains - every @dignite/* package resolves from public + # npmjs - so both workflows run the same yarn command; release.yml's step carries the longer + # account. (10.0.0-rc.16 briefly put a GitHub Packages URL back in the lockfile and reopened + # exactly that wound; CHANGELOG.md has the story and why the fix was to publish the dependency + # publicly rather than to keep authenticating against it here.) # # It matters for the duplicate check below specifically: npm dedupes graphs that Yarn Classic # splits into nested copies, so running that check after an npm install would pass vacuously. @@ -142,12 +132,10 @@ jobs: # # The targets are the libraries whose duplication would silently break DI at runtime, not # "everything installed": - # @dignite-projects - the original case (FLEX_FIELD_TYPES split across two copies), targeted - # under this scope rather than @dignite because angular/package.json aliases - # ng.flex-fields (etc.) to "npm:@dignite-projects/...@" as of rc.16 - # (see the job-level env: block's comment) - the installed manifests' - # "name" field is the real @dignite-projects/* identity regardless of which - # alias imported them, and that identity is what this check matches on. + # @dignite - the original case (FLEX_FIELD_TYPES split across two copies). Note this + # script matches on each installed manifest's own "name" field, so if these + # packages are ever aliased in package.json again, this target has to follow + # the alias TARGET's scope, not the name they are imported under. # @abp - CORE_OPTIONS, ConfigStateService, the environment tokens; every ABP # package in the tree peers on @abp/ng.core and would split with it. # ng-zorro-antd - unscoped, so the old scope-only invocation could not see it at all, and a @@ -173,7 +161,7 @@ jobs: working-directory: site/angular run: | node ../.github/scripts/check-angular-package-duplicates.mjs node_modules \ - @dignite-projects @abp ng-zorro-antd \ + @dignite @abp ng-zorro-antd \ @angular/core @angular/common @angular/forms @angular/router @angular/cdk # No lint step, matching release.yml: `ng lint site` currently fails on ~14 pre-existing diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 85acdd7..8c44952 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -40,35 +40,12 @@ jobs: contents: write # Required by softprops/action-gh-release to create a draft Release packages: write # Required to push pre-release NuGet/npm packages to GitHub Packages - # angular/.npmrc references ${PACKAGES_READ_TOKEN} to authenticate the @dignite-projects scope - # against GitHub Packages. As of 10.0.0-rc.16, angular/package.json aliases @dignite/ng.flex-fields - # (and its -ckeditor/-file-explorer adapters, and @dignite/ng.file-explorer) to - # "npm:@dignite-projects/@" (see the "Install Angular dependencies" step below for - # why), which is what actually routes those four through this scope/token - GitHub Packages' - # npm registry requires the scope to equal the owning org login, so @dignite itself has no - # registry entry there at all. setup-node's `cache: yarn` reads angular/.npmrc (to prime/verify - # the cache) before any later step gets a chance to export the token itself, so it has to be a - # job-level env, not just set on that step. (ci.yml carries the same env: block for the same - # reason; this comment is the one canonical copy of the reasoning - keep them in sync.) - # - # PACKAGES_READ_TOKEN (a PAT scoped to read:packages only), not secrets.GITHUB_TOKEN - the same - # choice "Verify packed NuGet packages restore cleanly" below already made, for the same - # documented reason: GITHUB_TOKEN's package access is scoped to the workflow's own repository, - # and these packages are published by a different one (abp-modules). Whether GITHUB_TOKEN would - # in fact be refused here has never been isolated - the CI 401s that led to this token were a - # different bug entirely (yarn was sending no token at all; see angular/.npmrc's own comment) - - # so this is the documented-behavior choice plus the NuGet side's precedent, not a measurement. - # If someone wants the ephemeral token back, that experiment is one commit and one CI run. - # - # To revert once abp-modules tags a release that mirrors flex-fields (rc.16 or a successor) to - # public npmjs again: drop the four npm: aliases in angular/package.json's dependencies and - # resolutions blocks back to plain semver ranges; change check-angular-package-duplicates.mjs's - # target list in both this file and ci.yml from @dignite-projects back to @dignite. Leave - # PACKAGES_READ_TOKEN itself and angular/.npmrc's @dignite-projects mapping in place either way - - # they're what "Verify packed NuGet packages restore cleanly" already depends on permanently, and - # cost nothing unused. - env: - PACKAGES_READ_TOKEN: ${{ secrets.PACKAGES_READ_TOKEN }} + # No job-level package credential: every @dignite/* dependency resolves from public npmjs, so + # the install below authenticates against nothing. The steps that genuinely need a token supply + # their own - "Verify packed NuGet packages restore cleanly" (PACKAGES_READ_TOKEN, for + # abp-modules' NuGet feed) and the two publish steps (GITHUB_TOKEN, for this repo's own + # packages). 10.0.0-rc.16 briefly required more than that, while it existed only on GitHub + # Packages; see CHANGELOG.md. steps: - name: Checkout site @@ -240,19 +217,14 @@ jobs: cache: yarn cache-dependency-path: site/angular/yarn.lock - # angular/.npmrc maps the @dignite-projects scope to GitHub Packages; ${GITHUB_TOKEN} in that - # file is a literal env-var placeholder npm/yarn substitute at read time, so it has to be - # present in the environment here (it is, job-level - see the env: block above). - # # Yarn with the committed lockfile, matching ci.yml and every developer machine. This step # used to be `npm install --no-package-lock` because Yarn Classic fetches a dependency whose # lockfile entry carries a GitHub Packages "resolved" URL through a code path that never - # attaches registry auth. That was fixed, and for a while every @dignite/* package resolved - # from public npmjs instead - but as of 10.0.0-rc.16, @dignite/* aliases back onto GitHub - # Packages (see the job-level env: block's comment), so this step is exercising that auth - # path again. --legacy-peer-deps is gone with npm: Yarn Classic does not enforce peer ranges, - # which is what that flag was working around (@swimlane/ngx-datatable@22 wants - # @angular/common 18-20.x, workspace is on 21.2.x). + # attaches registry auth. No such entry remains - every @dignite/* package resolves from public + # npmjs - so the release can be built from the tree the lockfile actually describes rather than + # from a fresh resolution that ignores it. --legacy-peer-deps is gone with npm: Yarn Classic + # does not enforce peer ranges, which is what that flag was working around + # (@swimlane/ngx-datatable@22 wants @angular/common 18-20.x, workspace is on 21.2.x). # # It also matters for the duplicate check below: npm dedupes graphs that Yarn Classic splits # into nested copies, so that check after an npm install would pass vacuously. @@ -271,7 +243,7 @@ jobs: working-directory: site/angular run: | node ../.github/scripts/check-angular-package-duplicates.mjs node_modules \ - @dignite-projects @abp ng-zorro-antd \ + @dignite @abp ng-zorro-antd \ @angular/core @angular/common @angular/forms @angular/router @angular/cdk # No lint step here: `ng lint site` currently fails on ~14 pre-existing violations (component @@ -335,15 +307,13 @@ jobs: # publishing" as well, so the plain npm install it runs is not subject to the # ${NODE_AUTH_TOKEN} placeholder that step writes into $NPM_CONFIG_USERCONFIG. # - # The trailing token argument is what lets this resolve @dignite/ng.flex-fields (etc.) while - # flex-fields stays GitHub-Packages-only, per the script's own header comment - without it, - # this step 404s the moment angular/projects/site/package.json names a flex-fields version - # that has no public-npmjs entry, which is exactly the gap 10.0.0-rc.16 exposed. It uses - # PACKAGES_READ_TOKEN rather than secrets.GITHUB_TOKEN for the reason the job-level env: - # block's comment gives (this is npm, not yarn, so the .npmrc scope-mapping trap that comment - # also mentions does not apply here - npm honors the alias target's own scope). + # No token argument: the packed manifest names its @dignite/* siblings by their public npmjs + # names, which is exactly where they resolve from. The script accepts an optional one for the + # case where they do not - see its header - which is what 10.0.0-rc.16 briefly needed while it + # was GitHub-Packages-only. That path is dormant, not dead: it is the thing to reach for if a + # flex-fields release is ever consumed before it reaches npmjs again. - name: Verify packed npm package installs and bundles cleanly - run: bash .github/scripts/verify-packed-npm-install.sh packed artifacts/npm/site '${{ secrets.PACKAGES_READ_TOKEN }}' + run: bash .github/scripts/verify-packed-npm-install.sh packed artifacts/npm/site # registry-url lives here rather than on the earlier Setup Node.js step - see that step's # comment for why no yarn command may run after it. It still has to run *before* the two @@ -435,13 +405,16 @@ jobs: # the gate's job now); what it still catches is a broken rename, and a registry that did not # end up serving what was pushed to it. # - # PACKAGES_READ_TOKEN, not secrets.GITHUB_TOKEN: @dignite-projects/ng.site itself is this - # repo's own package (GITHUB_TOKEN could read that much), but its rewritten dependencies now - # point at @dignite-projects/ng.flex-fields (etc.) from abp-modules - a different repository, - # which GITHUB_TOKEN cannot read regardless. See the job-level env: block's comment. + # Needs a credential for two different repositories' packages at once: @dignite-projects/ng.site + # is this repo's own, while the publish step above rewrote its @dignite/* dependencies into + # @dignite-projects/* aliases, which are abp-modules'. secrets.GITHUB_TOKEN covers both, and + # demonstrably does - 0.1.0-preview.11 passed this step that way, against flex-fields packages + # published by abp-modules - because dignite-projects/site is listed under those packages' + # "Manage Actions access". Worth knowing, because GITHUB_TOKEN's package access is otherwise + # documented as scoped to the workflow's own repository; that grant is what widens it. - name: Verify published npm package installs and bundles cleanly if: steps.channel.outputs.channel == 'preview' - run: bash .github/scripts/verify-packed-npm-install.sh published '${{ steps.channel.outputs.version }}' '${{ secrets.PACKAGES_READ_TOKEN }}' + run: bash .github/scripts/verify-packed-npm-install.sh published '${{ steps.channel.outputs.version }}' '${{ secrets.GITHUB_TOKEN }}' # Stable builds go to the public npmjs, under the real @dignite/ng.site name. Same # skip-when-not-configured pattern as the NuGet.org push above. diff --git a/CHANGELOG.md b/CHANGELOG.md index 3c0edde..7f4967a 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -14,68 +14,49 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 (Host dev app) and `angular/projects/site/package.json` (published library), picking up flex-fields' new built-in `Matrix`/`Table` field types. - Unlike every previous bump, rc.16 was published in abp-modules only via `workflow_dispatch` (no - tag), so it landed on GitHub Packages under the `@dignite-projects` org scope only - the - tag-triggered step that mirrors a release to public npmjs under the real `@dignite/*` scope never - ran. GitHub Packages' npm registry requires the scope to equal the owning org login, so - `@dignite/ng.flex-fields` has no registry entry there at all; the packages exist only as - `@dignite-projects/ng.flex-fields` etc. - - `angular/package.json`'s four entries (both `dependencies` and `resolutions`) now alias to - `npm:@dignite-projects/@` - the same rewrite `release.yml`'s "Publish pre-release - Angular package to GitHub Packages" step already applies to `@dignite/ng.site`'s own dependencies - at publish time - so `angular/.npmrc`'s existing `@dignite-projects:registry=...` mapping resolves - it. `angular/projects/site/package.json` keeps the plain, unaliased `@dignite/ng.flex-fields` - names: that manifest describes what a real downstream consumer needs, and either the publish-time - rewrite or (once flex-fields is public again) nothing at all is what bridges the gap - aliasing it - there would be wrong the moment the dependency is public again. - - `check-angular-package-duplicates.mjs`'s target list in both `ci.yml` and `release.yml` changed - from `@dignite` to `@dignite-projects`: the script matches each installed package's own manifest - `"name"` field, and every alias now on disk carries the real `@dignite-projects/*` identity - regardless of which name imported it - `@dignite` currently matches nothing installed, which the - script correctly treats as a hard failure rather than a vacuous pass. - - **`angular/.npmrc` maps the `@dignite` scope to GitHub Packages as well as `@dignite-projects`, - and that second line is what makes CI work at all.** Yarn Classic decides whether to attach a - registry's auth token to a *tarball* download by looking up the registry for the scope of the name - it knows the package by - and for an aliased package that is the **alias's** scope (`@dignite`), - not the target's (`@dignite-projects`). With only the target scope mapped, yarn fell back to the - default registry, saw that the tarball's host didn't match it, sent no credential at all, and - GitHub answered `401 Unauthorized`. It reproduces only on a cold yarn cache - a warm cache never - downloads the tarball and so never takes that code path - which is exactly why every local - `yarn install` passed while two consecutive CI runs failed. This is the same class of Yarn Classic - bug `release.yml`'s "Install Angular dependencies" comment has described since the last time a - GitHub Packages URL sat in `yarn.lock`; the alias is a new way into it. - - Along the way the same npm auth now uses `PACKAGES_READ_TOKEN` (the PAT-scoped-to-`read:packages` - secret `release.yml`'s "Verify packed NuGet packages restore cleanly" already used) instead of - `secrets.GITHUB_TOKEN`, matching the NuGet side and `GITHUB_TOKEN`'s documented "the workflow - repository only" package scoping. Note this was **not** what the 401s were about, and whether - `GITHUB_TOKEN` alone would have sufficed once the scope mapping was fixed was never isolated - - the token swap rides on documented behaviour and the NuGet precedent, not on a measurement. - `ci.yml`'s briefly-added `packages: read` permission is gone again, and no "Manage Actions access" - grant turned out to be required either. - - **`release.yml`'s "Verify packed npm package installs and bundles cleanly" (`packed` mode) step - would otherwise have failed on the next actual release attempt** - a real, verified break, not a - hypothetical one: it installs the *raw* packed `dist/site/package.json`, which still names its - siblings by their plain `@dignite/*` names and range (the alias rewrite only happens later, at the - GitHub Packages publish step), and the release's NuGet packages are already pushed live by the time - this step runs (`release.yml`'s "Push to GitHub Packages (pre-release)"/"Push to NuGet.org (stable)" - precede it), so the failure would have left a release half-published rather than merely failing - cleanly. Fixed by teaching `verify-packed-npm-install.sh`'s `packed` mode an optional third - `` argument: when given, it reads every `@dignite/*` range the packed tarball - itself declares (plus `@dignite/ng.file-explorer`'s, inferred from `@dignite/ng.flex-fields`'s own - range, since it never appears as a direct dependency of `@dignite/ng.site`) and points them at their - `npm:@dignite-projects/@` aliases via npm's `overrides` field - reading the range fresh - from the tarball rather than hardcoding it, so this keeps working across future flex-fields bumps - without a matching edit here. Its pre-existing `published` mode needed the identical fix, for the - identical reason, and had simply never been exercised against a GitHub-Packages-only flex-fields - version before now: `@dignite-projects/ng.site` is this repo's own package, but its rewritten - dependencies point at abp-modules'. `release.yml`'s two invocations now both pass - `secrets.PACKAGES_READ_TOKEN`. Verified against a real packed tarball with a personal PAT: fails - with the original `ETARGET` error without a token, installs and bundles cleanly with one. + Nothing else was needed for this: the packages resolve from public npmjs exactly as every prior + bump did. Getting there took a detour worth recording, though, because the conclusion was to change + the *dependency's* release rather than this repository. + + rc.16 was first published in abp-modules via `workflow_dispatch` only. That workflow mirrors a + release to public npmjs only on a tag push, so rc.16 existed solely on GitHub Packages - and there + under `@dignite-projects/*`, since GitHub Packages' npm registry requires the scope to equal the + owning org login. Consuming it from here meant aliasing all four packages to + `npm:@dignite-projects/@`, mapping that scope in `angular/.npmrc`, authenticating both + workflows against it, and repointing `check-angular-package-duplicates.mjs` at the alias target's + scope. All of that landed, and all of it is now reverted: pushing a `v10.0.0-rc.16` tag in + abp-modules put the packages on npmjs, which removed the reason for any of it. The deciding + argument was not effort but blast radius - a private-only dependency means every contributor needs + a `read:packages` credential just to `yarn install`, and CI on a fork PR cannot have one at all, + since GitHub does not pass secrets to fork-triggered runs. + + Two findings from the detour are worth keeping. + + **Yarn Classic will silently send no credential for an aliased package.** It picks the registry - + and hence the auth token - for a *tarball* download by the scope of the name it knows the package + by, which for an `npm:` alias is the **alias's** scope, not the target's. With only the target + scope mapped, yarn fell back to the default registry, found the tarball's host didn't match, sent + nothing, and GitHub answered `401 Unauthorized`. It reproduces only on a **cold** yarn cache - a + warm one never downloads the tarball and never reaches that code path - so every local + `yarn install` passed while two consecutive CI runs failed. The tell is in yarn's own output: + `Resolving packages` succeeding and `Fetching packages` 401ing means auth works for metadata and + the problem is the tarball path, i.e. not the credential. + + **A `${VAR}` placeholder in a committed `.npmrc` is a trap.** While a credential was needed it was + briefly written that way, which made *every* yarn invocation in `angular/` fail with + `Failed to replace env in config` whenever the variable was unset - including `yarn start`, + `yarn build` and `yarn test`, none of which touch a registry. Credentials belong in the user-level + `~/.npmrc`; the committed file names none. + + Along the way `release.yml`'s "Verify packed npm package installs and bundles cleanly" (`packed` + mode) turned out to be genuinely fragile: it installs the *raw* packed `dist/site/package.json`, so + it 404s on any flex-fields version not yet on npmjs - and it runs *after* the NuGet packages are + pushed live, so that failure would leave a release half-published rather than merely failing. + `verify-packed-npm-install.sh`'s `packed` mode now takes an optional token and, given one, + redirects every `@dignite/*` dependency the tarball declares through its `@dignite-projects` alias + via npm `overrides`, reading each range fresh from the tarball rather than hardcoding it. Nothing + passes that token today; it is there for the next time a dependency is consumed before it reaches + npmjs. Verified against a real packed tarball, with and without. ### Removed diff --git a/angular/.npmrc b/angular/.npmrc index e0916ae..c68e0bc 100644 --- a/angular/.npmrc +++ b/angular/.npmrc @@ -1,17 +1,10 @@ -# @dignite-projects is where the packages actually live on GitHub Packages (its npm registry -# requires the scope to equal the owning org login). +# Only needed by release.yml, which publishes this workspace's own library to GitHub Packages under +# @dignite-projects/ng.site for the pre-release channel (GitHub Packages' npm registry requires the +# scope to equal the owning org login, so the public @dignite/ng.site name cannot be used there). +# That step supplies its own credential; nothing here needs one, and no token belongs in a committed +# .npmrc anyway - a ${VAR} placeholder makes every yarn command in this directory fail outright when +# the variable is unset, including ones that never touch a registry. +# +# Ordinary `yarn install` needs no authentication at all: every @dignite/* dependency resolves from +# public npmjs. @dignite-projects:registry=https://npm.pkg.github.com - -# @dignite is mapped too, and it is not redundant: angular/package.json aliases these packages as -# "@dignite/ng.flex-fields": "npm:@dignite-projects/ng.flex-fields@", and Yarn Classic picks -# the registry - and therefore the auth token - for a tarball download by the scope of the name it -# knows the package by, which for an aliased package is the ALIAS's scope (@dignite), not the -# target's. Without this line yarn falls back to the default registry, sees that the tarball's host -# doesn't match it, sends no token at all, and GitHub answers 401 - on a cold cache only, which is -# what makes it a CI-only failure that a warm local yarn cache hides completely. (Metadata requests -# still go to @dignite-projects via the alias, so this line never makes yarn ask GitHub Packages for -# a package under the @dignite scope, which would 404.) -@dignite:registry=https://npm.pkg.github.com - -//npm.pkg.github.com/:_authToken=${PACKAGES_READ_TOKEN} -//npm.pkg.github.com/:always-auth=true diff --git a/angular/package.json b/angular/package.json index d83f2d4..f5e1377 100644 --- a/angular/package.json +++ b/angular/package.json @@ -28,10 +28,10 @@ "@abp/ng.feature-management": "~10.5.0", "@abp/ng.theme.lepton-x": "~5.5.0", "@volo/abp.commercial.ng.ui": "~10.5.0", - "@dignite/ng.flex-fields": "npm:@dignite-projects/ng.flex-fields@^10.0.0-rc.16", - "@dignite/ng.flex-fields-ckeditor": "npm:@dignite-projects/ng.flex-fields-ckeditor@^10.0.0-rc.16", - "@dignite/ng.flex-fields-file-explorer": "npm:@dignite-projects/ng.flex-fields-file-explorer@^10.0.0-rc.16", - "@dignite/ng.file-explorer": "npm:@dignite-projects/ng.file-explorer@^10.0.0-rc.16", + "@dignite/ng.flex-fields": "^10.0.0-rc.16", + "@dignite/ng.flex-fields-ckeditor": "^10.0.0-rc.16", + "@dignite/ng.flex-fields-file-explorer": "^10.0.0-rc.16", + "@dignite/ng.file-explorer": "^10.0.0-rc.16", "@ckeditor/ckeditor5-angular": "^11.2.0", "ckeditor5": "^48.0.0", "marked": "^18.0.0", @@ -54,8 +54,8 @@ "zone.js": "~0.15.0" }, "resolutions": { - "@dignite/ng.flex-fields": "npm:@dignite-projects/ng.flex-fields@10.0.0-rc.16", - "@dignite/ng.file-explorer": "npm:@dignite-projects/ng.file-explorer@10.0.0-rc.16" + "@dignite/ng.flex-fields": "10.0.0-rc.16", + "@dignite/ng.file-explorer": "10.0.0-rc.16" }, "devDependencies": { "@abp/ng.schematics": "~10.5.0", diff --git a/angular/yarn.lock b/angular/yarn.lock index 6091009..e13aad1 100644 --- a/angular/yarn.lock +++ b/angular/yarn.lock @@ -2277,18 +2277,18 @@ resolved "https://registry.yarnpkg.com/@ctrl/tinycolor/-/tinycolor-4.2.0.tgz#ba5d0b917303c0b3d3c14c4865cdc6ded25ac05f" integrity sha512-kzyuwOAQnXJNLS9PSyrk0CWk35nWJW/zl/6KvnTBMFK65gm7U1/Z5BqjxeapjZCIhQcM/DsrEmcbRwDyXyXK4A== -"@dignite/ng.file-explorer@^10.0.0-rc.16", "@dignite/ng.file-explorer@npm:@dignite-projects/ng.file-explorer@10.0.0-rc.16", "@dignite/ng.file-explorer@npm:@dignite-projects/ng.file-explorer@^10.0.0-rc.16": +"@dignite/ng.file-explorer@10.0.0-rc.16", "@dignite/ng.file-explorer@^10.0.0-rc.16": version "10.0.0-rc.16" - resolved "https://npm.pkg.github.com/download/@dignite-projects/ng.file-explorer/10.0.0-rc.16/a35232dea2c6faed5aad17e0fcb1c8b1de3e6eef#a35232dea2c6faed5aad17e0fcb1c8b1de3e6eef" - integrity sha512-RcWuPROHc6qIMXhX1mbatTI5d11zBWm79NujO8Hi5nnzqkHRRAD/C/hNtdOfb754xt3LYT0Gv0s1Il9mbV984g== + resolved "https://registry.yarnpkg.com/@dignite/ng.file-explorer/-/ng.file-explorer-10.0.0-rc.16.tgz#839bb3fa231fb5e625b8997f6ea78a2aa37d7cac" + integrity sha512-S8o1mNb3tNa+RLejSsMxAmXHCd+fUHJsajbSeMnCuhBn2J/lRo9rjVwk+0kwzAbmaK+Y0JysO4ywyESr2Nv3xw== dependencies: "@abp/ng.components" "~10.5.0" tslib "^2.0.0" -"@dignite/ng.flex-fields-ckeditor@npm:@dignite-projects/ng.flex-fields-ckeditor@^10.0.0-rc.16": +"@dignite/ng.flex-fields-ckeditor@^10.0.0-rc.16": version "10.0.0-rc.16" - resolved "https://npm.pkg.github.com/download/@dignite-projects/ng.flex-fields-ckeditor/10.0.0-rc.16/8265aaa1fbde7b6cadc941cb215ed02371a2dd4b#8265aaa1fbde7b6cadc941cb215ed02371a2dd4b" - integrity sha512-T2L+dhsyptJolVwhsUVu1KeB44JtFbonN/wwp8qifF+dzb7/cXlPC4RnhDRUeE72tIgAyAfoTg9MjRePhXH8fw== + resolved "https://registry.yarnpkg.com/@dignite/ng.flex-fields-ckeditor/-/ng.flex-fields-ckeditor-10.0.0-rc.16.tgz#4b737342f164e6143639763bf10706a7ba365b3d" + integrity sha512-MBtVBXpLWNFj/lDCFVNhvVryyowKI7mas6ghhLAL4/d0fDPzvoBTLaqDjh7qWNjpqevL1HCGsB1gm3hDYE7T6g== dependencies: "@ckeditor/ckeditor5-angular" "^11.2.0" "@ckeditor/ckeditor5-integrations-common" "^2.4.0" @@ -2297,19 +2297,19 @@ marked "^18.0.0" tslib "^2.0.0" -"@dignite/ng.flex-fields-file-explorer@npm:@dignite-projects/ng.flex-fields-file-explorer@^10.0.0-rc.16": +"@dignite/ng.flex-fields-file-explorer@^10.0.0-rc.16": version "10.0.0-rc.16" - resolved "https://npm.pkg.github.com/download/@dignite-projects/ng.flex-fields-file-explorer/10.0.0-rc.16/0420525b7560eec22238a030ffc0b69f69c360f0#0420525b7560eec22238a030ffc0b69f69c360f0" - integrity sha512-id14OEIRjAUCqq4IzDUtLW0xQRrjmRiWHdNFV14m4+jmwmFMs+lwDjqMwofmz85EhQO9Uv6u+XXIdVSEuzz5Cw== + resolved "https://registry.yarnpkg.com/@dignite/ng.flex-fields-file-explorer/-/ng.flex-fields-file-explorer-10.0.0-rc.16.tgz#f77de240690c27930bfe4e500e40a01438f0a7dd" + integrity sha512-kzXNK0EhEmKjjHjpdJPrv7K3f8f/XviukgPaeGYx0kvRW/wWyCwRZ8o5hvbyxjZtARYDQQLGX+IHRYfTpUyFww== dependencies: "@dignite/ng.file-explorer" "^10.0.0-rc.16" "@dignite/ng.flex-fields" "^10.0.0-rc.16" tslib "^2.0.0" -"@dignite/ng.flex-fields@^10.0.0-rc.16", "@dignite/ng.flex-fields@npm:@dignite-projects/ng.flex-fields@10.0.0-rc.16", "@dignite/ng.flex-fields@npm:@dignite-projects/ng.flex-fields@^10.0.0-rc.16": +"@dignite/ng.flex-fields@10.0.0-rc.16", "@dignite/ng.flex-fields@^10.0.0-rc.16": version "10.0.0-rc.16" - resolved "https://npm.pkg.github.com/download/@dignite-projects/ng.flex-fields/10.0.0-rc.16/c4796de06fcd3ed585897afcdb04d69b838fb87b#c4796de06fcd3ed585897afcdb04d69b838fb87b" - integrity sha512-komP6TWK0+xegNB3RkiK+pBwGnJwarRt9IhpEhah5vRDLQRhrwyZ+uKj/5Jl2wpZCwOMoWJtU8VoLTJ69j7MCw== + resolved "https://registry.yarnpkg.com/@dignite/ng.flex-fields/-/ng.flex-fields-10.0.0-rc.16.tgz#f5d2df96597ab9d2fdd45a5f479be3a48a18ff88" + integrity sha512-uF7QhVJ9K87rNdhgQpCW3CtosOUnG64y8MHwiXi+us4z/6Isuyltlh7mvxn4FtBYwTErVYNhNAj3vjQbzfl0Lw== dependencies: "@abp/ng.components" "~10.5.0" tslib "^2.0.0"