ci: route the SDK release install through the internal Verdaccio cache - #4426
Conversation
Adds the shared pinned ever-co/ever-gauzy configure-registry action before yarn install in release.sdk.prod.yml, paired with a restore step right after the install: this workflow later runs git add . + push (changeset version bumps) and publishes to npmjs, so the rewritten yarn.lock and the appended registry lines in the tracked .npmrc/.yarnrc must never survive past the install. Restore puts tracked files back and removes untracked leftovers. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
Included review availability: Your plan provides up to 4 included reviews per hour; 1 remains after this review. WalkthroughThe production SDK release workflow configures Verdaccio before dependency installation. An always-run cleanup step restores registry-related files and removes generated rewrite artifacts. The spellchecker allows the new registry terms. ChangesSDK production registry lifecycle
Estimated code review effort: 3 (Moderate) | ~20 minutes Merge Risk: 🔵 Low · up to The release install now uses the internal cache and then restores repository files before publishing. Mergeable with owner follow-up to confirm that the active npm configuration is restored to npmjs and that all rewritten lockfile artifacts are safely handled before automated commits. Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Up to standards ✅🟢 Issues
|
There was a problem hiding this comment.
Pull request overview
Updates the SDK release workflow to route dependency installation through the internal Verdaccio cache while preserving npmjs publishing.
Changes:
- Adds the pinned registry configuration action before installation.
- Restores lockfile and registry files before build and publish.
- Critical: The cross-repository action can access the publish credential inherited via
NODE_AUTH_TOKEN; authentication must be scoped or isolated.
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| - name: Configure Registry | ||
| uses: ever-co/ever-gauzy/.github/actions/configure-registry@9459d29e9a3859740348bb445dfe885cae83fc88 | ||
| with: | ||
| verdaccio-registry: ${{ vars.VERDACCIO_REGISTRY }} | ||
| verdaccio-token: ${{ secrets.VERDACCIO_TOKEN }} |
|
Dependency limit exceeded — report not shown. This pull request scan exceeded the 10,000-dependency limit applied to this scan, so the results are incomplete and may be inaccurate. To avoid reporting false positives, Socket has not posted a report. Upgrade your plan to raise the dependency limit and get complete reports, or view the partial scan in the dashboard. Socket is always free for open source. If this is a non-commercial open source project, contact us to request a free Team account. |
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
2 issues found across 1 file
Prompt for AI agents (unresolved issues)
Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.
<file name=".github/workflows/release.sdk.prod.yml">
<violation number="1" location=".github/workflows/release.sdk.prod.yml:68">
P2: The Configure Registry action deletes this repository's tracked `.yarnrc` before `yarn install`, so the install ignores the pinned `yarn-path` and runs the runner's global Yarn version. Use an action revision that preserves existing `.yarnrc` settings, or merge the registry entry with the existing file before installing.</violation>
<violation number="2" location=".github/workflows/release.sdk.prod.yml:68">
P1: `Configure Registry` runs after the workflow writes the publish token to `~/.npmrc`, while job-level `NODE_AUTH_TOKEN` is inherited by this action. Move it before authentication and scope the token to only the install and publish steps.</violation>
</file>
Reply with feedback, questions, or to request a fix.
Re-trigger cubic
| echo "✅ NPM authentication configured" | ||
|
|
||
| - name: Configure Registry | ||
| uses: ever-co/ever-gauzy/.github/actions/configure-registry@9459d29e9a3859740348bb445dfe885cae83fc88 |
There was a problem hiding this comment.
P1: Configure Registry runs after the workflow writes the publish token to ~/.npmrc, while job-level NODE_AUTH_TOKEN is inherited by this action. Move it before authentication and scope the token to only the install and publish steps.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At .github/workflows/release.sdk.prod.yml, line 68:
<comment>`Configure Registry` runs after the workflow writes the publish token to `~/.npmrc`, while job-level `NODE_AUTH_TOKEN` is inherited by this action. Move it before authentication and scope the token to only the install and publish steps.</comment>
<file context>
@@ -64,9 +64,35 @@ jobs:
echo "✅ NPM authentication configured"
+ - name: Configure Registry
+ uses: ever-co/ever-gauzy/.github/actions/configure-registry@9459d29e9a3859740348bb445dfe885cae83fc88
+ with:
+ verdaccio-registry: ${{ vars.VERDACCIO_REGISTRY }}
</file context>
| echo "✅ NPM authentication configured" | ||
|
|
||
| - name: Configure Registry | ||
| uses: ever-co/ever-gauzy/.github/actions/configure-registry@9459d29e9a3859740348bb445dfe885cae83fc88 |
There was a problem hiding this comment.
P2: The Configure Registry action deletes this repository's tracked .yarnrc before yarn install, so the install ignores the pinned yarn-path and runs the runner's global Yarn version. Use an action revision that preserves existing .yarnrc settings, or merge the registry entry with the existing file before installing.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At .github/workflows/release.sdk.prod.yml, line 68:
<comment>The Configure Registry action deletes this repository's tracked `.yarnrc` before `yarn install`, so the install ignores the pinned `yarn-path` and runs the runner's global Yarn version. Use an action revision that preserves existing `.yarnrc` settings, or merge the registry entry with the existing file before installing.</comment>
<file context>
@@ -64,9 +64,35 @@ jobs:
echo "✅ NPM authentication configured"
+ - name: Configure Registry
+ uses: ever-co/ever-gauzy/.github/actions/configure-registry@9459d29e9a3859740348bb445dfe885cae83fc88
+ with:
+ verdaccio-registry: ${{ vars.VERDACCIO_REGISTRY }}
</file context>
…he workflow edit)
Greptile SummaryThe release workflow now configures the shared Verdaccio registry before installing dependencies, then restores registry-related checkout files before building and publishing SDK packages. The cleanup behavior was exercised in an isolated Git worktree with simulated registry mutations and a forced dependency-install failure. The cleanup ran afterward, restored Confidence Score: 5/5The release workflow safely isolates temporary registry configuration to dependency installation and restores the checkout before build and publication steps. The changed failure path was exercised with a forced install failure, and the exact cleanup commands restored tracked files and removed the temporary rewritten artifacts. Files Needing Attention: No files need further attention.
 T-Rex LogsWhat T-Rex did
Reviews (1): Last reviewed commit: "ci: route the SDK release install throug..." | Re-trigger Greptile |
…file probe) The previous pin died silently (exit 1, no output) on repos where .npmrc/ yarn.lock/package-lock.json are untracked - composite bash -e killed the bare 'git ls-files; tracked=$?' probe. Fixed upstream in ever-co/ever-gauzy#10029.
|
|
Note on the red License Compliance (FOSSA) check: it is pre-existing and unrelated — the same check fails on the other currently-open PRs (#4424, #4423, each "1 issues found" against the |
Part of the fleet-wide Verdaccio rollout (owner goal: traffic reduction — all repos resolve npm installs through the internal cache on self-hosted runners).
Uses the shared action
ever-co/ever-gauzy/.github/actions/configure-registrypinned to9459d29e(ever-co/ever-gauzy#10029), which probes the VIP and falls back to npmjs quietly on any runner that cannot reach it — GitHub-hosted fallback runs are unaffected.Per-job decisions:
release(RUNNER_LINUX_X64_4): Configure Registry added beforeyarn install --frozen-lockfile(yarn repo → the yarn.lock rewrite is load-bearing;--frozen-lockfiletolerates the registry-host rewrite because integrity hashes are unchanged).if: always()): this workflow later runsgit add .+git push(changeset version bumps) and then publishes to npmjs. A rewrittenyarn.lockor the registry lines the action appends to the tracked.npmrc/.yarnrcmust never be committed or influenceyarn publish— the restore puts every tracked file back (yarn.lock,.npmrc,.yarnrc) and removes untracked leftovers before any build/version/publish step runs.Only the install itself flows through the cache; the publish path (auth via
~/.npmrc+NODE_AUTH_TOKEN) is byte-identical to today.🤖 Generated with Claude Code
Summary by cubic
Routes the SDK release job’s dependency install through the internal Verdaccio cache to reduce external npm traffic. Previously installs always hit npmjs; now they use the cache when reachable and fall back to npmjs. Publish behavior is unchanged.
yarn install --frozen-lockfilein.github/workflows/release.sdk.prod.yml, usingever-co/ever-gauzy/.github/actions/configure-registry(now pinned to a version with an errexit-guarded tracked-file probe). The action probes the VIP and silently falls back to npmjs when unreachable.if: always()) immediately after install to revert anyyarn.lockrewrite and remove registry lines from tracked.npmrc/.yarnrc, preventing accidental commits and ensuringyarn publishuses npmjs via~/.npmrcandNODE_AUTH_TOKEN..cspell.jsonto includeyarnrcandUSERCONFIGto avoid false positives in CI.Written for commit eee7f23. Summary will update on new commits.
Summary by CodeRabbit