ci: guard against committing dependencies or build output - #381
Merged
Conversation
`scripts/node_modules` was committed and later untracked in d6cb2db. The files are gone from the tree, but .gitignore does not retract what is already in history and a clone downloads history, so ~1.7MB blobs such as stellar-sdk.js are paid for on every clone permanently. This repository got off lightly — 10MB on GitHub against a 1.4MB working tree, which is healthy and needs no remediation. The sibling soroban-cost-linter reached a 252MB clone through exactly the same mistake at a larger scale, and nothing in either repository prevented it: there is no pre-commit config and no size check in CI. Add two checks to the existing `lint` job, which is already a required status context, so no new context and no branch-protection change is needed: - fail on any tracked path under target/ or node_modules/ - fail on any tracked file over 5MB (largest legitimate file today is ~88KB) They run before the Rust toolchain setup so they fail in seconds. Verified that they pass on the current tree and that they catch a planted scripts/node_modules/pkg/index.js and a 6MB file. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01ToyjQ3F5ogZ4G2C3YRpH4N
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Investigation result: this repo is healthy
Following the 252MB clone problem found in soroban-cost-linter, I ran the same
investigation here. This repository does not have that problem:
No
target/directory has ever been committed. Largest currently tracked fileis 88KB. No remediation is needed, and documenting a blobless clone here
would be noise — a full clone already takes a couple of seconds.
But the same gap exists
History shows
scripts/node_moduleswas committed and later untracked ind6cb2db, leaving blobs likestellar-sdk.js(1.73MB),stellar-sdk-no-axios.js(1.66MB) and
stellar-base.js(1.24MB) in history permanently..gitignoreandgit rmstop future commits but do not retract what is already there.That is the identical mistake that took cost-linter to 252MB — caught early here,
so the damage stayed small. Nothing prevented it in either repo: no pre-commit
config, no size check in CI.
The guard
Two checks added to the existing
lintjob:target/ornode_modules/lintis already a required status context here, so unlike the sibling repothis needs no aggregating job and no branch-protection change. The checks run
before the Rust toolchain setup, so they fail in seconds rather than after a
build.
Verified in both directions: passes on the current tree, and catches a planted
scripts/node_modules/pkg/index.jsand a 6MB file. A guard nobody has seen failis not a guard.