@pnpm/building.policy 1100.0.16 → 1100.0.17

package/CHANGELOG.md

@@ -1,5 +1,23 @@
 # @pnpm/building.policy
 
+## 1100.0.17
+
+### Patch Changes
+
+- `allowBuilds` entries can now approve git-hosted packages that pnpm downloads as a tarball, such as `github:` dependencies (which are fetched from `codeload.github.com` rather than cloned), by their repository URL without the resolved commit hash. This matches the hashless `git+` matching already supported for cloned git dependencies. For example:
+
+  ```yaml
+  allowBuilds:
+    "foo@git+https://github.com/org/foo.git": true
+  ```
+
+  This approves the package whether pnpm clones it or downloads a tarball, so the entry no longer has to be updated every time the pinned commit changes. GitLab and Bitbucket tarball downloads are matched the same way. Approving or denying a specific resolved commit by its full tarball dep path continues to work.
+
+- Updated dependencies:
+  - @pnpm/config.version-policy@1100.1.11
+  - @pnpm/deps.path@1100.0.13
+  - @pnpm/types@1101.8.0
+
 ## 1100.0.16
 
 ### Patch Changes

package/lib/index.js

@@ -103,14 +103,57 @@ function isGitRepoAllowBuildKey(pkg) {
     return !pkg.includes('#') && isGitRepoDepPath(pkg);
 }
 function getGitRepoAllowBuildKeyFromDepPath(depPath) {
-    if (!isGitRepoDepPath(depPath))
-        return undefined;
-    const refStart = depPath.indexOf('#');
-    return refStart === -1 ? depPath : depPath.slice(0, refStart);
+    if (isGitRepoDepPath(depPath)) {
+        const refStart = depPath.indexOf('#');
+        return refStart === -1 ? depPath : depPath.slice(0, refStart);
+    }
+    // Packages installed from a git host as a downloaded tarball (e.g. the
+    // `github:` shortcut, which pnpm fetches from codeload.github.com rather
+    // than cloning) have a depPath built from the tarball URL, not a `git+`
+    // clone URL, so the check above misses them. Normalize the tarball URL back
+    // to the same `git+https://<host>/<repo>.git` repo key that a clone of the
+    // same repository would produce, so a single hashless `allowBuilds` entry
+    // approves the package however pnpm happened to fetch it.
+    return gitHostedTarballRepoKey(depPath);
 }
 function isGitRepoDepPath(depPath) {
     return depPath.startsWith('git+') || depPath.includes('@git+');
 }
+function gitHostedTarballRepoKey(pkgIdWithPatchHash) {
+    const { name, nonSemverVersion } = dp.parse(pkgIdWithPatchHash);
+    if (name == null || nonSemverVersion == null)
+        return undefined;
+    const repoUrl = gitHostedTarballRepoUrl(nonSemverVersion);
+    return repoUrl == null ? undefined : `${name}@${repoUrl}`;
+}
+// Reconstructs the committish-free repository URL from the download URL of a
+// git host that pnpm fetches as a tarball instead of cloning. The patterns
+// mirror the tarball templates in @pnpm/git-resolver (which come from
+// hosted-git-info, except GitLab's, which that package overrides). The host of
+// each known template is anchored so a look-alike download host (e.g.
+// `codeload.github.com.example.com`) cannot be rewritten into an unrelated
+// repo key, and each known download host claims its URLs exclusively: a URL on
+// codeload.github.com or bitbucket.org that does not match that host's tarball
+// pattern is rejected rather than falling through to the generic GitLab
+// pattern, so a malformed URL on a known host cannot be rewritten into that
+// host's trusted repo key either.
+function gitHostedTarballRepoUrl(tarballUrl) {
+    // GitHub: https://codeload.github.com/<owner>/<repo>/tar.gz/<committish>
+    if (tarballUrl.startsWith('https://codeload.github.com/')) {
+        const match = /^https:\/\/codeload\.github\.com\/([^/]+)\/([^/]+)\/tar\.gz\//.exec(tarballUrl);
+        return match == null ? undefined : `git+https://github.com/${match[1]}/${match[2]}.git`;
+    }
+    // Bitbucket: https://bitbucket.org/<owner>/<repo>/get/<committish>.tar.gz
+    if (tarballUrl.startsWith('https://bitbucket.org/')) {
+        const match = /^https:\/\/bitbucket\.org\/([^/]+)\/([^/]+)\/get\//.exec(tarballUrl);
+        return match == null ? undefined : `git+https://bitbucket.org/${match[1]}/${match[2]}.git`;
+    }
+    // GitLab (incl. self-hosted): https://<host>/<group…>/<repo>/-/archive/<ref>/…
+    // The project path may contain nested groups, so match up to the
+    // `/-/archive/<ref>/` marker rather than a fixed number of path segments.
+    const match = /^https:\/\/([^/]+)\/(.+?)\/-\/archive\/[^/]+\//.exec(tarballUrl);
+    return match == null ? undefined : `git+https://${match[1]}/${match[2]}.git`;
+}
 function isDepPathAllowBuildKey(pkg) {
     if (dp.removePeersSuffix(pkg) !== pkg)
         return true;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/building.policy",
-  "version": "1100.0.16",
+  "version": "1100.0.17",
   "description": "Create a function for filtering out dependencies that are not allowed to be built",
   "keywords": [
     "pnpm",
@@ -27,13 +27,13 @@
     "!*.map"
   ],
   "dependencies": {
-    "@pnpm/config.version-policy": "1100.1.10",
-    "@pnpm/deps.path": "1100.0.12",
-    "@pnpm/types": "1101.7.0"
+    "@pnpm/config.version-policy": "1100.1.11",
+    "@pnpm/deps.path": "1100.0.13",
+    "@pnpm/types": "1101.8.0"
   },
   "devDependencies": {
     "@jest/globals": "30.4.1",
-    "@pnpm/building.policy": "1100.0.16"
+    "@pnpm/building.policy": "1100.0.17"
   },
   "engines": {
     "node": ">=22.13"