fix: run postrelease scripts with npm - #51
Conversation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Advanced Run ID: 📒 Files selected for processing (5)
Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review. 📝 WalkthroughWalkthroughThe repository now restricts dependency build scripts during pnpm installation. It permits Changespnpm build controls
Estimated code review effort: 1 (Trivial) | ~5 minutes Merge Risk: ⚪ Minimal · up to Dependency installs now use an explicit restricted build-script policy across CI, allowing the required hook dependency while blocking spawn-sync. No current merge-blocking risk is identified. 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
4a029f8 to
a12fd2d
Compare
Kikobeats
changed the title
a12fd2d to
71128c6
Compare
Kikobeats
changed the title
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 71128c6. Configure here.
The release job failed with ERR_PNPM_IGNORED_BUILDS. The `--dangerously-allow-all-builds` flag on the install step is fine; the failure came from an install nobody asked for. `standard-version` rewrites package.json, then `pnpm release:tags` runs, and pnpm's verify-deps-before-run reinstalls first. That implicit install carries no flag and aborts on simple-git-hooks and spawn-sync. npm runs the script without reinstalling, so the flag keeps doing its job on the install step and nothing else changes. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
71128c6 to
54705b7
Compare
Kikobeats
changed the title
1 participant
What broke
Run 34081791051 failed at the release step:
The
--dangerously-allow-all-buildsflag on the Install step is not the problem. The failure came from a second install nobody asked for:standard-versionrewritespackage.json, thenpostreleaserunspnpm release:tags, and pnpm's verify-deps-before-run reinstalls before running the script. That implicit install carries no flag, so it aborts.The flag cannot reach it either:
pnpm --dangerously-allow-all-builds release:tagsfails the same way, because pnpm passes the flag on to the script rather than to its own install.What changed
postreleaseruns its scripts withnpm runinstead ofpnpm. npm does not reinstall before running a script, so the implicit install disappears. Workflows are untouched and the flag keeps doing its job on the install step.How it was tested
Against pnpm 12.3.4, what CI resolves
version: latestto. Install with the flag, bump thepackage.jsonversion the waystandard-versiondoes, then run the release script:(
--dry-runappended to the push, so nothing was written.)npm test(lint + ava): 1035 tests passed, coverage unchanged at 96.7%.Outcome
The release job reaches
npm publishinstead of exiting 1. The repo is stuck at v1.4.16 with v1.4.17 aborted mid-flight; this unblocks it.Note
Medium Risk
Touches the release/publish script chain only, but a mistake here could block or mis-run tagging and npm publish.
Overview
The
postreleasehook now invokesrelease:tagsandrelease:githubwithnpm runinstead ofpnpm, so those steps are not executed under pnpm’s script runner.That avoids pnpm 12’s
verify-deps-before-runpath (triggered afterstandard-versionrewritespackage.json) from doing an implicit install that rejects ignored dependency build scripts and fails the release job.Reviewed by Cursor Bugbot for commit 54705b7. Bugbot is set up for automated code reviews on this repo. Configure here.