Repository navigation
ci: allow devDependencies that are production transitives - #3671
Merged
Merged
Conversation
The packaged dependency check treated every `devDependencies` entry as forbidden. A package can legitimately be both: a direct devDependency used by build scripts and a transitive of a runtime dependency. `semver` is one example — declared for tooling and also pulled in by electron-updater — and it currently fails the check on every build. Subtract the production closure (`pnpm list --prod --depth Infinity --json`) from `devDependencies`, so only packages that exist purely for development are rejected. Genuinely dev-only packages (renderer libraries Vite bundles, build tooling, type packages) are still flagged.
|
Contributor
|
🎉 This pull request is included in Gitify v8.1.0! 🎉 Downloads for macOS, Windows, and Linux are available on the release page. Thanks for helping make Gitify better! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes the false positive that is currently failing every build:
[FAIL] Packaged dependency surface is invalid: Dev-only package must not ship: semver.A package can be both a direct
devDependencyand a production transitive.FORBIDDEN_PACKAGESis now derived as:where the production closure comes from
pnpm list --prod --depth Infinity --json(everything reachable fromdependencies, including transitives).Why
semveris declared as a devDependency for tooling and pulled in byelectron-updater, so electron-builder ships it legitimately. The previous rule rejected it purely because the name appears indevDependencies. The same would happen for any shared transitive (debug,ms,js-yaml,sax, …).Genuinely dev-only packages are still rejected: renderer libraries that Vite bundles, build tooling, and type packages.
Verification
Run against a real packaged asar (a sibling Electron app using this same script):
[PASS] Packaged dependency surface is valid.semveradded todevDependencies(the failing case) →[PASS], becausesemveris in the production closure[FAIL], naming each of themoxfmt --checkpasses; no runtime or packaging changes.