declapract-typescript-ehmpathy 0.49.9 → 0.49.11

package/dist/.test/assets/pnpm/declarations/practices/pnpm/bad-practices/package-lock-json/package-lock.json.declapract.ts

@@ -0,0 +1,41 @@
+import type { FileCheckFunction, FileFixFunction } from 'declapract';
+
+import { existsSync } from 'node:fs';
+import path from 'node:path';
+
+/**
+ * .what = detects a `package-lock.json` (the npm lockfile) that is SAFE to remove — i.e. only
+ *         once a `pnpm-lock.yaml` sits beside it.
+ * .why  = the npm→pnpm migration must be FORGET-NOT-DESTROY: `package-lock.json` is removed ONLY
+ *         after `pnpm-lock.yaml` exists, so a fix interrupted midway never leaves the repo
+ *         lockfile-less (the wish's stated safety bar). a bare `FileCheckType.EXISTS` would let
+ *         declapract's default fix delete the npm lockfile UNCONDITIONALLY — even on a repo that
+ *         has not yet run `pnpm install` — which is exactly the destructive strip this gate
+ *         forecloses. so the delete is gated on the pnpm lockfile's presence, read from the
+ *         project root via `context.getProjectRootDirectory()`.
+ */
+const hasPnpmLock = (context: {
+  getProjectRootDirectory: () => string;
+}): boolean =>
+  existsSync(path.join(context.getProjectRootDirectory(), 'pnpm-lock.yaml'));
+
+export const check: FileCheckFunction = (contents, context) => {
+  // no package-lock.json → no npm lockfile to remove, skip
+  if (contents === null) throw new Error('does not match bad practice');
+
+  // forget-not-destroy: without a pnpm-lock.yaml beside it, removal would leave the repo
+  // lockfile-less — so this is NOT yet a safe-to-remove npm lockfile, skip
+  if (!hasPnpmLock(context)) throw new Error('does not match bad practice');
+
+  // package-lock.json present AND pnpm-lock.yaml present → safe to remove, detected
+  return;
+};
+
+export const fix: FileFixFunction = (contents, context) => {
+  // gate the delete on the pnpm lockfile's presence (forget-not-destroy) — a fix that ran
+  // where the check would not detect leaves the file untouched, never lockfile-less
+  if (!hasPnpmLock(context)) return { contents };
+
+  // pnpm-lock.yaml exists → remove the redundant npm lockfile
+  return { contents: null };
+};

package/dist/.test/assets/pnpm/declarations/practices/pnpm/best-practice/.declapract.readme.md

@@ -0,0 +1,22 @@
+# pnpm best-practice — what this practice owns, and what it does NOT
+
+this practice owns the pnpm **adoption** signal: the `packageManager` exact pin
+(`pnpm@10.31.7`, an intentional org-convergence requirement — see the `.declapract.ts` note).
+
+## where the hoisted-linker `.npmrc` lives — NOT here
+
+the pnpm-only `.npmrc` directives an expo repo needs (`node-linker=hoisted`,
+`public-hoist-pattern[]=*expo*`, …) are declared by the **`node`** practice, not this one. the
+`node` practice owns the whole `.npmrc` (it is the package-manager-config file), and its declaration
+is usecase-aware: it findserts the hoist block only when the `cicd-app-react-native-expo` usecase is
+present.
+
+so an auditor of all that pnpm needs should also read:
+
+- `src/practices/node/best-practice/.npmrc.declapract.ts` — the usecase-aware `.npmrc` declaration
+- `src/utils/defineExpectedNpmrcContents.ts` — the shared base + expo-hoist line source
+- `.agent/repo=.this/role=any/briefs/howto.pnpm-expo-hoisted-linker.md` — why the flat linker is
+  required for metro/expo, and the transitive-skew gotcha it exposes
+
+the split is deliberate: the `.npmrc` is one file with one owner (`node`), so a repo gets a single
+coherent `.npmrc` rather than two practices that fight over it.

package/dist/.test/assets/pnpm/declarations/practices/pnpm/best-practice/package.json

@@ -0,0 +1,3 @@
+{
+  "packageManager": "pnpm@10.31.7"
+}

package/dist/.test/assets/pnpm/declarations/practices/pnpm/best-practice/package.json.declapract.ts

@@ -0,0 +1,15 @@
+import { FileCheckType } from 'declapract';
+
+/**
+ * .what = pins `packageManager` to an EXACT pnpm version (`pnpm@10.31.7`), not a minVersion.
+ * .why  = this is an intentional org-standardization REQUIREMENT, not an oversight. every pnpm
+ *         consumer runs ONE blessed pnpm version, so `corepack` / `pnpm/action-setup@v4` load the
+ *         identical toolchain across CI, local, and every repo — reproducible installs, no per-repo
+ *         drift. an exact pin is also the ONLY correct shape here: the `packageManager` field is a
+ *         corepack spec that requires the `pnpm@<version>` prefix, which declapract's bare-semver
+ *         `check.minVersion(..)` cannot emit.
+ * .note = a consumer ahead of the pin (e.g. on 10.32.1) is pinned BACK to the blessed version on
+ *         `declapract fix` — that convergence-to-one-version is the intent, not a regression. when
+ *         the org bumps the blessed version, this pin bumps and every consumer follows.
+ */
+export const check = FileCheckType.CONTAINS;

package/dist/.test/assets/pnpm/declarations/useCases.yml

@@ -0,0 +1,7 @@
+# minimal pnpm-only usecase for the npm→pnpm migration integration tests
+# .why = scopes the apply to the pnpm practice alone, so no other practice's
+#        variables are needed to evaluate the usecase.
+use-cases:
+  pnpm-repo:
+    practices:
+      - pnpm

package/dist/__snapshots__/actionPins.declapract.integration.test.ts.snap

@@ -0,0 +1,70 @@
+// Jest Snapshot v1, https://jestjs.io/docs/snapshot-testing
+
+exports[`action pins given: [case1] every yaml template declared under a practice .github tree when: [t2] the refs are read together then: the pin table reads as declared -- if the diff surprises you, a bump reached more or fewer sites than intended 1`] = `
+[
+  "Entle/action-pagerduty-alert@e6ca54cd88948b8a50f5bb1071dfa5bdb149ce7e — 1 site",
+  "actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 — 19 sites",
+  "actions/checkout@11d5960a326750d5838078e36cf38b85af677262 — 22 sites",
+  "actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 — 3 sites",
+  "actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 — 1 site",
+  "actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 — 18 sites",
+  "actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 — 1 site",
+  "amannn/action-semantic-pull-request@e32d7e603df1aa1ba07e981f2a23455dee596825 — 1 site",
+  "aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a — 13 sites",
+  "expo/expo-github-action@c7b66a9c327a43a8fa7c0158e7f30d6040d2481e — 2 sites",
+  "hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd — 3 sites",
+  "pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 — 1 site",
+]
+`;
+
+exports[`action pins given: [case2] every yaml under this repo's own .github tree when: [t2] the refs are read together then: the pin table reads as declared -- if the diff surprises you, a bump reached more or fewer sites than intended 1`] = `
+[
+  "actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 — 12 sites",
+  "actions/checkout@11d5960a326750d5838078e36cf38b85af677262 — 12 sites",
+  "actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 — 3 sites",
+  "actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 — 1 site",
+  "actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 — 11 sites",
+  "actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 — 1 site",
+  "amannn/action-semantic-pull-request@e32d7e603df1aa1ba07e981f2a23455dee596825 — 1 site",
+  "aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a — 4 sites",
+  "hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd — 1 site",
+  "pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 — 1 site",
+]
+`;
+
+exports[`action pins given: [case6] a corpus that is defective on purpose, one line per defect when: [t0] the defective corpus is read the way the walk reads a real one then: and the pin table still reads, defects and all: the pin table over a defective corpus 1`] = `
+[
+  "actions/checkout@11d5960a326750d5838078e36cf38b85af677262 + deadbeefdeadbeefdeadbeefdeadbeefdeadbeef + v4 — 3 sites",
+  "actions/setup-node@cafebabecafebabecafebabecafebabecafebabe — 1 site",
+  "pnpm/action-setup@b906aff — 1 site",
+]
+`;
+
+exports[`action pins given: [case6] a corpus that is defective on purpose, one line per defect when: [t0] the defective corpus is read the way the walk reads a real one then: the drift report names the repo and both shas -- which is what tells a maintainer the bump reached some sites and missed others: drifted -- the report a half-applied bump produces 1`] = `
+[
+  "actions/checkout — 11d5960a326750d5838078e36cf38b85af677262 vs deadbeefdeadbeefdeadbeefdeadbeefdeadbeef",
+]
+`;
+
+exports[`action pins given: [case6] a corpus that is defective on purpose, one line per defect when: [t0] the defective corpus is read the way the walk reads a real one then: the unpinned report names each offender with a path an editor accepts -- if this snapshot ever carries an absolute path, the label named the machine that ran the suite: unpinned -- the report a tag ref and a short sha produce 1`] = `
+[
+  "src/practices/cicd-demo/best-practice/.github/workflows/deploy.yml:1 — actions/checkout@v4",
+  "src/practices/cicd-demo/best-practice/.github/workflows/deploy.yml:5 — pnpm/action-setup@b906aff",
+]
+`;
+
+exports[`action pins given: [case6] a corpus that is defective on purpose, one line per defect when: [t0] the defective corpus is read the way the walk reads a real one then: the untailed report names each ref whose sha records no provenance: untailed -- the report a bare sha produces 1`] = `
+[
+  "src/practices/cicd-demo/best-practice/.github/workflows/deploy.yml:1 — actions/checkout@v4",
+  "src/practices/cicd-demo/best-practice/.github/workflows/deploy.yml:2 — actions/setup-node@cafebabecafebabecafebabecafebabecafebabe",
+]
+`;
+
+exports[`action pins given: [case6] a corpus that is defective on purpose, one line per defect when: [t1] the corpus is empty then: every report reads as empty rather than absent: the reports over a corpus of zero refs 1`] = `
+{
+  "drifted": [],
+  "table": [],
+  "unpinned": [],
+  "untailed": [],
+}
+`;