@catladder/cli 0.0.0-next-a2f59d07 → 0.0.0-next-cf4e99eb

package/dist/bundles/catenv/index.js

@@ -6096,11 +6096,14 @@ const createNodeDockerJobDefinition = async (context) => {
         (0, packageManagerInstall_1.getDockerAppCopyAndBuildScript)(context),
         context.packageManagerInfo,
     ]);
-    // the pnpm store (pulled via the cache above) is copied into the
-    // image so the prod install works offline — like the yarn zip cache,
-    // which travels inside the copied `.yarn` config folder
-    const copyPnpmStore = packageManagerInfo.type === "pnpm" &&
-        packageManagerInfo.componentIsInWorkspace;
+    // The pnpm store is deliberately NOT copied into the image. It used
+    // to be, so the prod install could link instead of hitting the
+    // registry — but the store lands in an earlier layer than
+    // node_modules, so pnpm cannot hardlink across the overlay boundary
+    // and copies every package instead. Measured on one component: the
+    // in-image install was *slower* that way (28s vs 10s from the
+    // registry), the store added 3GB to the build context and the final
+    // image, and the build took 339s instead of 27s.
     // pnpm copies every workspace manifest into the image — as individual
     // COPY instructions that many layers exceed docker's depth limit, so
     // the job tars them up and a single ADD extracts them
@@ -6108,8 +6111,6 @@ const createNodeDockerJobDefinition = async (context) => {
     const WORKSPACE_FILES_TAR = ".catladder-workspace-files.tar";
     return {
         script: [
-            // the COPY source must exist even when the cache was cold
-            ...(copyPnpmStore ? ["mkdir -p .pnpm-store"] : []),
             ...(isPnpm
                 ? [
                     `tar -cf ${WORKSPACE_FILES_TAR} ${packageManagerInfo.pathsToCopyInDocker.join(" ")}`,
@@ -6126,14 +6127,10 @@ const createNodeDockerJobDefinition = async (context) => {
                     `ADD ${WORKSPACE_FILES_TAR} /app/`,
                     // ADD does not apply --chown to extracted tars, and parent
                     // dirs of the entries come out root-owned — fix ownership
-                    // while the stage still runs as root (store not copied yet,
-                    // so this only touches the small manifest tree). Custom
-                    // base images without a node user run as root and don't
-                    // need it, hence the fallback
+                    // while the stage still runs as root (this only touches the
+                    // small manifest tree). Custom base images without a node
+                    // user run as root and don't need it, hence the fallback
                     `RUN chown -R node:node /app || true`,
-                    ...(copyPnpmStore
-                        ? [`COPY --chown=node:node .pnpm-store /app/.pnpm-store`]
-                        : []),
                 ].join("\n")
                 : packageManagerInfo.pathsToCopyInDocker
                     .map((dir) => `COPY --chown=node:node ${dir} /app/${dir}`)
@@ -6167,10 +6164,9 @@ const lodash_es_1 = __nccwpck_require__(50210);
 const path_1 = __nccwpck_require__(16928);
 const slugify_1 = __importDefault(__nccwpck_require__(84007));
 /**
- * stable reference between the two node caches: the package-manager
- * (yarn zip / pnpm store) cache declares itself redundant when the
- * node_modules cache scored an exact-lockfile hit (github skips the
- * ~0.6GB download on warm runs)
+ * stable reference between the two yarn caches: the zip cache declares
+ * itself redundant when the node_modules cache scored an exact-lockfile
+ * hit (github skips the ~0.6GB download on warm runs)
  */
 const NODE_MODULES_CACHE_ID = "node-modules";
 /**
@@ -6198,36 +6194,36 @@ const getCacheBaseDir = async (context) => {
         : ".";
 };
 /**
- * the package manager's download cache: yarn's `.yarn` zip cache, or
- * pnpm's content-addressable store (which catladder points at a
- * project-local `.pnpm-store`, see the install script)
+ * the package manager's download cache: yarn's `.yarn` zip cache.
+ *
+ * pnpm gets nothing. Its store is a content-addressable tree of
+ * hundreds of thousands of small files, and moving it costs more than
+ * the install it saves: measured on a 3800-package monorepo, restoring
+ * the 1 GB store took ~53s on gitlab (which zips file by file) and
+ * ~23s on github, against a from-registry install of ~30-40s. See
+ * getNodeModulesCache for the node_modules half of the same finding.
  */
 const getYarnCache = async (context, policy = "pull-push") => {
     const packageManagerInfo = await context.packageManagerInfo;
-    const isPnpm = packageManagerInfo.type === "pnpm";
+    if (packageManagerInfo.type === "pnpm")
+        return [];
     const baseDir = await getCacheBaseDir(context);
-    // pnpm keeps its store in a format-versioned subdir (v10, v11, ...)
-    // and never cleans old ones up — scope the cache slot by major so a
-    // pnpm upgrade starts a fresh slot instead of dragging the dead old
-    // store tree along in every cache transfer (formats change only on
-    // majors)
-    const pnpmStoreKey = `pnpm-v${packageManagerInfo.version.split(".")[0]}`;
     return [
         {
             scope: "buildDir",
             pathMode: "relative",
             buildDir: baseDir,
-            key: isPnpm ? pnpmStoreKey : "yarn",
+            key: "yarn",
             policy,
-            paths: [isPnpm ? ".pnpm-store" : ".yarn"],
+            paths: [".yarn"],
             // content-key for immutable-cache backends (github); the lockfile
             // decides whether the cached content could have changed
-            keyFiles: [isPnpm ? "pnpm-lock.yaml" : "yarn.lock"],
-            // the package manager's download cache (~hundreds of MB) is only
-            // read when packages have to be (re)installed. When the
-            // node_modules cache hit for the same lockfile, install verifies
-            // its state file and never touches the store — so github skips
-            // downloading this cache entirely
+            keyFiles: ["yarn.lock"],
+            // the yarn zip cache (~hundreds of MB) is only read when packages
+            // have to be (re)installed. When the node_modules cache hit for
+            // the same lockfile, install verifies its state file and never
+            // touches the zips — so github skips downloading this cache
+            // entirely
             redundantOnExactHitOf: NODE_MODULES_CACHE_ID,
         },
     ];
@@ -6236,12 +6232,18 @@ exports.getYarnCache = getYarnCache;
 const getNodeModulesCache = async (context, policy = "pull-push") => {
     const packageManagerInfo = await context.packageManagerInfo;
     const baseDir = await getCacheBaseDir(context);
-    const { workspaces } = packageManagerInfo;
-    const isPnpm = packageManagerInfo.type === "pnpm";
-    const lockFileName = isPnpm ? "pnpm-lock.yaml" : "yarn.lock";
-    // yarn berry tracks install state in .yarn/install-state.gz (pnpm's
-    // equivalent lives inside node_modules and is covered by the paths)
-    const hasInstallState = packageManagerInfo.type === "yarn" && !packageManagerInfo.isClassic;
+    // pnpm gets no node_modules cache either: archiving the tree (root
+    // plus every workspace's symlink farm, >1GB in real monorepos) costs
+    // ~190s per saving job to spare ~6s of install, and a safe pnpm slot
+    // must be keyed by lockfile hash (a pnpm install over a node_modules
+    // from a different lockfile leaves orphaned .pnpm dirs that break
+    // type identity), so it misses on every dependency change anyway.
+    // pnpm projects run entirely uncached — see getYarnCache
+    if (packageManagerInfo.type === "pnpm")
+        return [];
+    const lockFileName = "yarn.lock";
+    // yarn berry tracks install state in .yarn/install-state.gz
+    const hasInstallState = !packageManagerInfo.isClassic;
     // We intentionally do not use the contents of the lockfile as a cache key, as install should always guarantee that the files are updated, but it can still use part of the cache if not all packages are up-to-date.
     // It would slow down all pipelines whenever one adds a new dependency as it will need to download all node_modules again.
     return [
@@ -6249,19 +6251,7 @@ const getNodeModulesCache = async (context, policy = "pull-push") => {
             scope: "global",
             pathMode: "absolute",
             // we use the dirname, not the component name, because in certain cases we have two apps in the same directory and want to share the cache, e.g. when having storybook in the same package.json
-            //
-            // pnpm gets its own, lockfile-keyed cache: node_modules layouts
-            // are not compatible between package managers (a migrating
-            // project must not inherit the yarn slot), and unlike yarn, a
-            // pnpm install on top of a node_modules from a different lockfile
-            // leaves orphaned .pnpm dirs behind that break type identity —
-            // so the slot changes whenever the lockfile changes
-            key: isPnpm
-                ? {
-                    prefix: "pnpm-" + (0, slugify_1.default)(baseDir) + "-node-modules",
-                    files: [(0, path_1.join)(baseDir, "pnpm-lock.yaml")],
-                }
-                : (0, slugify_1.default)(baseDir) + "-node-modules",
+            key: (0, slugify_1.default)(baseDir) + "-node-modules",
             // content-key for immutable-cache backends (github); the lockfile
             // decides whether the cached content could have changed (absolute
             // pathMode: resolve the lockfile explicitly)
@@ -6272,12 +6262,6 @@ const getNodeModulesCache = async (context, policy = "pull-push") => {
             policy,
             paths: (0, lodash_es_1.uniq)([
                 (0, path_1.join)(baseDir, "node_modules"),
-                // pnpm's per-package node_modules are symlink farms worth
-                // keeping warm (yarn hoists into the root, so root-only
-                // matches its historical behavior)
-                ...(isPnpm
-                    ? workspaces.map((w) => (0, path_1.join)(w.location, "node_modules"))
-                    : []),
                 ...(hasInstallState ? [(0, path_1.join)(baseDir, ".yarn/install-state.gz")] : []),
             ]),
         },
@@ -6445,7 +6429,7 @@ exports.createMeteorBuildJobs = createMeteorBuildJobs;
 "use strict";
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.getDockerAppCopyAndBuildScript = exports.getPackageManagerInstall = exports.ensureNodeVersion = exports.getDefaultAuditCommand = void 0;
+exports.getDockerAppCopyAndBuildScript = exports.getPackageManagerInstall = exports.ensureNodeVersion = exports.getDefaultAuditCommand = exports.DEFAULT_AUDIT_LEVEL = void 0;
 const bash_1 = __nccwpck_require__(94143);
 const utils_1 = __nccwpck_require__(49401);
 const gitlab_1 = __nccwpck_require__(86962);
@@ -6469,33 +6453,38 @@ const isInWorkspace = (context, packageManagerInfo) => context.type === "workspa
  */
 const getEnsurePnpmCommand = (version) => `if ! command -v pnpm &> /dev/null; then corepack enable pnpm 2>/dev/null || npm install -g pnpm@${version}; fi`;
 /**
- * pnpm's store is global by default; point it at a project-local
- * directory so CI can cache it (the pnpm equivalent of the `.yarn`
- * zip cache). Passed as the --store-dir flag: pnpm 11 stopped reading
- * the npm_config_store_dir env var (settings only come from
- * pnpm-workspace.yaml / global config / CLI flags), the flag works on
- * v10 and v11
- */
-const getPnpmStoreDirExpression = (inWorkspace) => inWorkspace
-    ? `"$(git rev-parse --show-toplevel 2>/dev/null || pwd)/.pnpm-store"`
-    : `"$PWD/.pnpm-store"`;
-const getPnpmInstallCommands = (context, packageManagerInfo) => [
+ * pnpm jobs use pnpm's own (global, per-runner) store location. There
+ * used to be a `--store-dir` pointing at a project-local
+ * `.pnpm-store`, so CI could cache it — that cache is gone (see
+ * getYarnCache), and keeping the store inside the repo only meant it
+ * landed in docker build contexts.
+ */
+const getPnpmInstallCommands = (packageManagerInfo) => [
     getEnsurePnpmCommand(packageManagerInfo.version),
-    `pnpm install --frozen-lockfile --store-dir ${getPnpmStoreDirExpression(isInWorkspace(context, packageManagerInfo))}`,
+    `pnpm install --frozen-lockfile`,
 ];
+exports.DEFAULT_AUDIT_LEVEL = "critical";
 /**
- * default `audit` job command per package manager. Exhaustive on the
- * package-manager type and throws for anything unsupported, so adding a
- * new package manager surfaces every place that needs a command here.
+ * default `audit` job command per package manager, failing on advisories
+ * of `level` and above. Exhaustive on the package-manager type and throws
+ * for anything unsupported, so adding a new package manager surfaces every
+ * place that needs a command here.
  */
-const getDefaultAuditCommand = (packageManagerInfo) => {
+const getDefaultAuditCommand = (packageManagerInfo, level = exports.DEFAULT_AUDIT_LEVEL) => {
     switch (packageManagerInfo.type) {
         case "pnpm":
-            return "pnpm audit --prod --audit-level critical";
+            return `pnpm audit --prod --audit-level ${level}`;
         case "yarn":
             return packageManagerInfo.isClassic
-                ? "yarn audit --level critical"
-                : "yarn npm audit --environment production --severity critical"; // yarn 2+
+                ? // classic walks the whole tree; --groups limits it to production
+                    `yarn audit --level ${level} --groups dependencies`
+                : // yarn 2+ audits only the CURRENT workspace's DIRECT dependencies
+                    // by default — in a monorepo that is the root manifest, which
+                    // usually has no production dependencies at all, so the job passed
+                    // without checking anything. --all covers every workspace,
+                    // --recursive the transitive dependencies (what `pnpm audit` and
+                    // `yarn audit` classic do on their own).
+                    `yarn npm audit --environment production --severity ${level} --all --recursive`;
         default:
             throw new Error(`no audit command implemented for package manager "${packageManagerInfo.type}"`);
     }
@@ -6516,7 +6505,7 @@ const getPackageManagerInstall = async (context, options) => {
         ? context.build.config.postInstall
         : null;
     const installSection = packageManagerInfo.type === "pnpm"
-        ? (0, gitlab_1.collapseableSection)("pnpminstall", "pnpm install")(getPnpmInstallCommands(context, packageManagerInfo))
+        ? (0, gitlab_1.collapseableSection)("pnpminstall", "pnpm install")(getPnpmInstallCommands(packageManagerInfo))
         : (0, gitlab_1.collapseableSection)("yarninstall", "Yarn install")([getYarnInstallCommand(packageManagerInfo)]);
     return [
         ...(0, exports.ensureNodeVersion)(context),
@@ -6529,11 +6518,12 @@ const getPackageManagerInstall = async (context, options) => {
 exports.getPackageManagerInstall = getPackageManagerInstall;
 const DOCKER_COPY_FILES = `COPY --chown=node:node $APP_DIR .`;
 const getPnpmDockerAppCopyAndBuildScript = (packageManagerInfo) => {
-    // the store was copied into the image (like the yarn zip cache), so
-    // the prod install links from it instead of hitting the registry
-    const storeDir = packageManagerInfo.componentIsInWorkspace
-        ? "/app/.pnpm-store"
-        : "/app/$APP_DIR/.pnpm-store";
+    // the prod install downloads from the registry: nothing is copied
+    // into the image to link from (see createNodeDockerJobDefinition).
+    // The store it fills is scratch space outside /app, dropped in the
+    // same layer so the packages ship once — node_modules holds
+    // hardlinks, so removing the store keeps the files alive
+    const storeDir = "/tmp/pnpm-store";
     // in a workspace, only install the component (and its workspace
     // dependencies) — the pnpm equivalent of `yarn workspaces focus`.
     // npm package names are shell-safe unquoted (the whole script is
@@ -6545,7 +6535,7 @@ const getPnpmDockerAppCopyAndBuildScript = (packageManagerInfo) => {
     return new bash_1.BashExpression(`
 ${DOCKER_COPY_FILES}
 RUN command -v pnpm >/dev/null 2>&1 || npm install -g pnpm@${packageManagerInfo.version}
-RUN pnpm install --prod --frozen-lockfile --store-dir ${storeDir}${filter}
+RUN pnpm install --prod --frozen-lockfile --store-dir ${storeDir}${filter} && rm -rf ${storeDir}
     `.trim());
 };
 const getDockerAppCopyAndBuildScript = async (context) => {
@@ -6608,7 +6598,7 @@ const cache_1 = __nccwpck_require__(74559);
 const constants_1 = __nccwpck_require__(5576);
 const packageManagerInstall_1 = __nccwpck_require__(28419);
 const createNodeTestJobs = async (context) => {
-    var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k, _l, _m, _o, _p, _q, _r, _s, _t, _u, _v, _w, _x, _y, _z, _0, _1, _2, _3;
+    var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k, _l, _m, _o, _p, _q, _r, _s, _t, _u, _v, _w, _x, _y, _z, _0, _1, _2, _3, _4;
     // don't run tests after release
     // TODO: this will be replaced by using rules
     if (context.trigger === "taggedRelease") {
@@ -6654,11 +6644,11 @@ const createNodeTestJobs = async (context) => {
             script: [
                 `cd ${context.build.dir}`,
                 ...((_f = (0, utils_1.ensureArrayOrNull)((_e = buildConfig.audit) === null || _e === void 0 ? void 0 : _e.command)) !== null && _f !== void 0 ? _f : [
-                    (0, packageManagerInstall_1.getDefaultAuditCommand)(packageManagerInfo),
+                    (0, packageManagerInstall_1.getDefaultAuditCommand)(packageManagerInfo, (_g = buildConfig.audit) === null || _g === void 0 ? void 0 : _g.level),
                 ]),
             ],
-            allow_failure: (_h = (_g = buildConfig.audit) === null || _g === void 0 ? void 0 : _g.allowFailure) !== null && _h !== void 0 ? _h : true,
-            ...(0, createArtifactsConfig_1.createArtifactsConfig)(context.build.dir, (_j = buildConfig.audit) === null || _j === void 0 ? void 0 : _j.artifactsReports, (_k = buildConfig.audit) === null || _k === void 0 ? void 0 : _k.artifacts),
+            allow_failure: (_j = (_h = buildConfig.audit) === null || _h === void 0 ? void 0 : _h.allowFailure) !== null && _j !== void 0 ? _j : true,
+            ...(0, createArtifactsConfig_1.createArtifactsConfig)(context.build.dir, (_k = buildConfig.audit) === null || _k === void 0 ? void 0 : _k.artifactsReports, (_l = buildConfig.audit) === null || _l === void 0 ? void 0 : _l.artifacts),
         })
         : null;
     const lintJob = buildConfig.lint !== false
@@ -6667,20 +6657,20 @@ const createNodeTestJobs = async (context) => {
             ...base,
             runnerVariables: {
                 ...constants_1.NODE_RUNNER_BUILD_VARIABLES,
-                ...((_m = (_l = buildConfig.lint) === null || _l === void 0 ? void 0 : _l.runnerVariables) !== null && _m !== void 0 ? _m : {}),
+                ...((_o = (_m = buildConfig.lint) === null || _m === void 0 ? void 0 : _m.runnerVariables) !== null && _o !== void 0 ? _o : {}),
             },
-            image: (_p = (_o = buildConfig.lint) === null || _o === void 0 ? void 0 : _o.jobImage) !== null && _p !== void 0 ? _p : defaultImage,
+            image: (_q = (_p = buildConfig.lint) === null || _p === void 0 ? void 0 : _p.jobImage) !== null && _q !== void 0 ? _q : defaultImage,
             caches: nodeCache,
             script: [
                 ...(0, packageManagerInstall_1.ensureNodeVersion)(context),
                 `cd ${context.build.dir}`,
                 ...packageManagerInstall,
-                ...((_r = (0, utils_1.ensureArrayOrNull)((_q = buildConfig.lint) === null || _q === void 0 ? void 0 : _q.command)) !== null && _r !== void 0 ? _r : [
+                ...((_s = (0, utils_1.ensureArrayOrNull)((_r = buildConfig.lint) === null || _r === void 0 ? void 0 : _r.command)) !== null && _s !== void 0 ? _s : [
                     (0, runScript_1.runScript)(packageManagerInfo.type, "lint"),
                 ]),
             ],
-            allow_failure: (_s = buildConfig.lint) === null || _s === void 0 ? void 0 : _s.allowFailure,
-            ...(0, createArtifactsConfig_1.createArtifactsConfig)(context.build.dir, (_t = buildConfig.lint) === null || _t === void 0 ? void 0 : _t.artifactsReports, (_u = buildConfig.lint) === null || _u === void 0 ? void 0 : _u.artifacts),
+            allow_failure: (_t = buildConfig.lint) === null || _t === void 0 ? void 0 : _t.allowFailure,
+            ...(0, createArtifactsConfig_1.createArtifactsConfig)(context.build.dir, (_u = buildConfig.lint) === null || _u === void 0 ? void 0 : _u.artifactsReports, (_v = buildConfig.lint) === null || _v === void 0 ? void 0 : _v.artifacts),
         })
         : null;
     const testJob = buildConfig.test !== false
@@ -6689,22 +6679,22 @@ const createNodeTestJobs = async (context) => {
             ...base,
             runnerVariables: {
                 ...constants_1.NODE_RUNNER_BUILD_VARIABLES,
-                ...((_w = (_v = buildConfig.test) === null || _v === void 0 ? void 0 : _v.runnerVariables) !== null && _w !== void 0 ? _w : {}),
+                ...((_x = (_w = buildConfig.test) === null || _w === void 0 ? void 0 : _w.runnerVariables) !== null && _x !== void 0 ? _x : {}),
             },
             // browser tests need a jobImage carrying the browser, e.g. the
             // official playwright image (version-matched to the project)
-            image: (_y = (_x = buildConfig.test) === null || _x === void 0 ? void 0 : _x.jobImage) !== null && _y !== void 0 ? _y : (0, runner_1.getRunnerImage)("jobs-default"),
+            image: (_z = (_y = buildConfig.test) === null || _y === void 0 ? void 0 : _y.jobImage) !== null && _z !== void 0 ? _z : (0, runner_1.getRunnerImage)("jobs-default"),
             caches: nodeCache,
             script: [
                 ...(0, packageManagerInstall_1.ensureNodeVersion)(context),
                 `cd ${context.build.dir}`,
                 ...packageManagerInstall,
-                ...((_0 = (0, utils_1.ensureArrayOrNull)((_z = buildConfig.test) === null || _z === void 0 ? void 0 : _z.command)) !== null && _0 !== void 0 ? _0 : [
+                ...((_1 = (0, utils_1.ensureArrayOrNull)((_0 = buildConfig.test) === null || _0 === void 0 ? void 0 : _0.command)) !== null && _1 !== void 0 ? _1 : [
                     (0, runScript_1.runScript)(packageManagerInfo.type, "test"),
                 ]),
             ],
-            allow_failure: (_1 = buildConfig.test) === null || _1 === void 0 ? void 0 : _1.allowFailure,
-            ...(0, createArtifactsConfig_1.createArtifactsConfig)(context.build.dir, (_2 = buildConfig.test) === null || _2 === void 0 ? void 0 : _2.artifactsReports, (_3 = buildConfig.test) === null || _3 === void 0 ? void 0 : _3.artifacts),
+            allow_failure: (_2 = buildConfig.test) === null || _2 === void 0 ? void 0 : _2.allowFailure,
+            ...(0, createArtifactsConfig_1.createArtifactsConfig)(context.build.dir, (_3 = buildConfig.test) === null || _3 === void 0 ? void 0 : _3.artifactsReports, (_4 = buildConfig.test) === null || _4 === void 0 ? void 0 : _4.artifacts),
         })
         : null;
     return [auditJob, lintJob, testJob].filter(utils_1.notNil);