@xemahq/repo-build-tooling 0.27.1 → 0.27.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xemahq/repo-build-tooling",
-  "version": "0.27.1",
+  "version": "0.27.2",
   "description": "Dev-time build tooling shared by every Xema repository. Ships as plain ESM, depending only on @xemahq/release-policy for registry access, so the published artifact is the reviewed source.",
   "license": "Apache-2.0",
   "author": "Neuralchowder Inc. <developer@xema.dev> (https://xema.dev)",
@@ -50,6 +50,6 @@
     "test": "node src/scrub-swagger-plugin-paths.mjs --self-test && node --test src/check-workspace-range-matches-local.test.mjs && node --test src/check-no-vendored-deps.test.mjs && node --test src/readiness.test.mjs && node --test src/composed-image.test.mjs && node --test src/composed-image-coordinate-cli.test.mjs && node --test src/declaration-refusal.test.mjs && node --test src/smoke-refusal.test.mjs && node --test src/load-image.test.mjs && node --test src/composed-image-coordinate.test.mjs && node --test src/composed-image-dockerfile.test.mjs && node --test src/service-bootstrap.test.mjs && node --test src/service-bootstrap-protocols.test.mjs && node --test src/composed-image-prebuilt-dockerfile.test.mjs && node --test src/composed-image-in-image-closure.test.mjs && node --test src/composed-image-stage.test.mjs && node --test src/composed-image-stage-tree.test.mjs && node --test src/composed-image-install.test.mjs && node --test src/composed-image-proof.test.mjs && node --test src/composed-image-pnpm-context.test.mjs && node --test src/composed-image-sync-injected.test.mjs && node --test src/composed-image-prisma-check.test.mjs && node --test src/composed-image-prisma-engine.test.mjs && node --test src/composed-migrate.test.mjs && node --test src/promote-image.test.mjs && node --test src/arm64-supplement-needed.test.mjs && node --test src/service-image.test.mjs && node --test src/image-cpu-arch.test.mjs"
   },
   "xemaRelease": {
-    "sourceDigest": "sha256:65b9132685b9423a89b13ec6d03b21f3c7c66c529c98fbf09ee6a7bd4cde39d9"
+    "sourceDigest": "sha256:3a4f2d10146fe209afa48b5f783954e50bd239602444a7a59920cc7196169c6b"
   }
 }

package/src/composed-image-install.mjs

@@ -4,8 +4,12 @@
 // for the members' closures only and checked to pin nothing new, then production dependencies are
 // installed from the runner's pnpm store alone (`--offline`, `--ignore-scripts`), selected for the
 // TARGET platform (`--os/--cpu/--libc`) so no foreign-platform binary is staged.
+//
+// The re-resolve runs in a scratch copy of the tree's manifests, never in the tree: pnpm 10.33 `--lockfile-only`
+// with a filter that leaves workspace projects out still links a full `node_modules` (dev dependencies included),
+// and the `--prod` install after it does not prune it, so dev-only packages would ship and be scanned.
 import { execFileSync } from 'node:child_process';
-import { copyFileSync, mkdtempSync, rmSync } from 'node:fs';
+import { copyFileSync, mkdirSync, mkdtempSync, readdirSync, rmSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 
@@ -31,21 +35,41 @@ export const productionInstallCommand = (filters, arch) => [
   '--os=linux', `--cpu=${nodeArch(arch)}`, `--libc=${libcOf(arch)}`,
 ];
 
+/** The root files a resolve reads, beside every workspace `package.json` and patch file. */
+const RESOLVE_ROOT_FILES = Object.freeze(['package.json', 'pnpm-lock.yaml', 'pnpm-workspace.yaml', '.npmrc', '.pnpmfile.cjs']);
+
+/** Copy what `pnpm install --lockfile-only` reads from `treeRoot` into `resolveRoot`: no sources, no `node_modules`. */
+export function copyResolveInputs(treeRoot, resolveRoot, directory = '') {
+  for (const entry of readdirSync(join(treeRoot, directory), { withFileTypes: true })) {
+    const path = join(directory, entry.name);
+    if (entry.isDirectory()) {
+      if (entry.name !== 'node_modules' && entry.name !== '.git') copyResolveInputs(treeRoot, resolveRoot, path);
+    } else if (entry.isFile() && (entry.name === 'package.json' || entry.name.endsWith('.patch') || (directory === '' && RESOLVE_ROOT_FILES.includes(entry.name)))) {
+      mkdirSync(join(resolveRoot, directory), { recursive: true });
+      copyFileSync(join(treeRoot, path), join(resolveRoot, path));
+    }
+  }
+}
+
 const defaultExec = (file, args, { cwd }) => execFileSync(file, args, { cwd, stdio: 'inherit' });
 
 /**
  * Install the members' production closure into `treeRoot` (which holds the root manifests, the lockfile and the
  * closure's package files). `filters` are the members' literal `--filter <package>...` words. Throws when the
- * re-resolve pinned a registry package the committed lockfile does not.
+ * re-resolve pinned a registry package the committed lockfile does not. Only the re-resolved `pnpm-lock.yaml` comes
+ * back from the scratch copy, so the tree's `node_modules` is the production install's alone.
  */
 export function installClosure({ treeRoot, filters, arch, exec = defaultExec }) {
   const scratch = mkdtempSync(join(tmpdir(), 'xema-composed-lock-'));
   try {
     const committed = join(scratch, 'pnpm-lock.committed.yaml');
     copyFileSync(join(treeRoot, 'pnpm-lock.yaml'), committed);
+    const resolveRoot = join(scratch, 'resolve');
+    copyResolveInputs(treeRoot, resolveRoot);
     const [resolveFile, ...resolveArgs] = lockfileOnlyCommand(filters);
-    exec(resolveFile, resolveArgs, { cwd: treeRoot });
-    assertPinsUnchanged({ root: treeRoot, committedLockfile: committed });
+    exec(resolveFile, resolveArgs, { cwd: resolveRoot });
+    assertPinsUnchanged({ root: resolveRoot, committedLockfile: committed });
+    copyFileSync(join(resolveRoot, 'pnpm-lock.yaml'), join(treeRoot, 'pnpm-lock.yaml'));
     const [installFile, ...installArgs] = productionInstallCommand(filters, arch);
     exec(installFile, installArgs, { cwd: treeRoot });
     // pnpm 10.33 frozen offline install does not filter by libc; cpu/os do.

package/src/composed-image-install.test.mjs

@@ -1,4 +1,5 @@
 import assert from 'node:assert/strict';
+import { execFileSync } from 'node:child_process';
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
@@ -15,11 +16,23 @@ function tree(committed) {
   return treeRoot;
 }
 
-test('the re-resolve then the production install run in the tree, offline and frozen, for the target platform, with the literal filters', () => {
+test('the re-resolve runs in a scratch copy of the manifests, then the production install runs in the tree, offline and frozen, for the target platform, with the literal filters', () => {
   const treeRoot = tree(lock('left-pad@1.3.0'));
+  fs.writeFileSync(path.join(treeRoot, 'package.json'), '{"name":"root"}');
+  fs.mkdirSync(path.join(treeRoot, 'apps/a/dist'), { recursive: true });
+  fs.writeFileSync(path.join(treeRoot, 'apps/a/package.json'), '{"name":"@t/a"}');
+  fs.writeFileSync(path.join(treeRoot, 'apps/a/dist/main.js'), '');
   const calls = [];
-  installClosure({ treeRoot, filters: FILTERS, arch: 'arm64', exec: (file, args, options) => calls.push({ line: [file, ...args], cwd: options.cwd }) });
-  assert.deepEqual(calls.map((c) => c.cwd), [treeRoot, treeRoot]);
+  const exec = (file, args, options) => {
+    const seen = fs.readdirSync(options.cwd, { recursive: true }).sort();
+    if (args.includes('--lockfile-only')) fs.writeFileSync(path.join(options.cwd, 'pnpm-lock.yaml'), `${lock('left-pad@1.3.0')}# re-resolved\n`);
+    calls.push({ line: [file, ...args], cwd: options.cwd, seen });
+  };
+  installClosure({ treeRoot, filters: FILTERS, arch: 'arm64', exec });
+  assert.notEqual(calls[0].cwd, treeRoot);
+  assert.deepEqual(calls[0].seen, ['apps', 'apps/a', 'apps/a/package.json', 'package.json', 'pnpm-lock.yaml']);
+  assert.equal(calls[1].cwd, treeRoot);
+  assert.match(fs.readFileSync(path.join(treeRoot, 'pnpm-lock.yaml'), 'utf8'), /# re-resolved/, 'the re-resolved lockfile came back into the tree');
   assert.deepEqual(calls[0].line, lockfileOnlyCommand(FILTERS));
   assert.deepEqual(calls[1].line, productionInstallCommand(FILTERS, 'arm64'));
   const install = calls[1].line.join(' ');
@@ -32,10 +45,43 @@ test('the re-resolve then the production install run in the tree, offline and fr
 test('a re-resolution that pins a registry package the committed lockfile does not stops before the install', () => {
   const treeRoot = tree(lock('left-pad@1.3.0'));
   const calls = [];
-  const exec = (file, args) => {
+  const exec = (file, args, options) => {
     calls.push(args);
-    if (args.includes('--lockfile-only')) fs.writeFileSync(path.join(treeRoot, 'pnpm-lock.yaml'), lock('left-pad@1.3.0', 'evil@9.9.9'));
+    if (args.includes('--lockfile-only')) fs.writeFileSync(path.join(options.cwd, 'pnpm-lock.yaml'), lock('left-pad@1.3.0', 'evil@9.9.9'));
   };
   assert.throws(() => installClosure({ treeRoot, filters: FILTERS, arch: 'amd64', exec }), /pinned registry package\(s\) the committed lockfile does not:\n {2}- evil@9\.9\.9/);
   assert.equal(calls.length, 1, 'the production install never ran');
+  assert.doesNotMatch(fs.readFileSync(path.join(treeRoot, 'pnpm-lock.yaml'), 'utf8'), /evil/, 'the refused lockfile never reached the tree');
+});
+
+// Real pnpm, no registry: `file:` packages only. pnpm 10.33 `--lockfile-only` with a filter that leaves a workspace
+// project out links a full node_modules, dev dependencies included; the `--prod` install after it never prunes them.
+test('after the install the tree holds the production closure only: no dev-only package, even when the filter leaves a project out', () => {
+  const treeRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'xema-install-real-'));
+  const write = (file, json) => {
+    fs.mkdirSync(path.dirname(path.join(treeRoot, file)), { recursive: true });
+    fs.writeFileSync(path.join(treeRoot, file), JSON.stringify(json));
+  };
+  try {
+    write('package.json', { name: 'root', private: true });
+    fs.writeFileSync(path.join(treeRoot, 'pnpm-workspace.yaml'), "packages:\n  - 'apps/*'\n");
+    write('vendor/prod-only/package.json', { name: 'prod-only', version: '1.0.0' });
+    write('vendor/dev-only/package.json', { name: 'dev-only', version: '1.0.0' });
+    const deps = { dependencies: { 'prod-only': 'file:../../vendor/prod-only' }, devDependencies: { 'dev-only': 'file:../../vendor/dev-only' } };
+    write('apps/lib/package.json', { name: '@t/lib', version: '1.0.0', ...deps });
+    write('apps/a/package.json', { name: '@t/a', version: '1.0.0', ...deps, dependencies: { ...deps.dependencies, '@t/lib': 'workspace:*' } });
+    write('apps/other/package.json', { name: '@t/other', version: '1.0.0', devDependencies: deps.devDependencies });
+    execFileSync('pnpm', ['install', '--lockfile-only', '--offline'], { cwd: treeRoot, stdio: 'ignore' });
+
+    // CI=true as on the runner, where pnpm keeps a modules directory it would otherwise refuse to reuse without a TTY.
+    const exec = (file, args, { cwd }) => execFileSync(file, args, { cwd, stdio: 'pipe', env: { ...process.env, CI: 'true' } });
+    installClosure({ treeRoot, filters: ['--filter', '@t/a...'], arch: 'arm64', exec });
+
+    const entries = fs.readdirSync(path.join(treeRoot, 'node_modules', '.pnpm'));
+    assert.ok(entries.some((entry) => entry.startsWith('prod-only@')), `the prod dependency is installed: ${entries}`);
+    assert.ok(!entries.some((entry) => entry.startsWith('dev-only@')), `no dev-only package is installed: ${entries}`);
+    assert.match(fs.readFileSync(path.join(treeRoot, 'pnpm-lock.yaml'), 'utf8'), /injectWorkspacePackages: true/, 'the tree holds the re-resolved lockfile');
+  } finally {
+    fs.rmSync(treeRoot, { recursive: true, force: true });
+  }
 });