Skip to content

use npm ci #2140

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
hardyjosh merged 16 commits into from
Sep 16, 2025
Merged

use npm ci #2140

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
16 commits
Select commit Hold shift + click to select a range
0e6a3a4
use npm ci
rouzwelt Sep 9, 2025
9f604e6
fix
rouzwelt Sep 9, 2025
645e706
lint
rouzwelt Sep 10, 2025
066f03a
fix CI
rouzwelt Sep 10, 2025
15a9376
test
rouzwelt Sep 10, 2025
fa856b4
Update npm-package-release.yml
rouzwelt Sep 10, 2025
ef09189
Update npm-package-release.yml
rouzwelt Sep 10, 2025
7ea7bcb
Update npm-package-release.yml
rouzwelt Sep 10, 2025
4547131
bloklist checker
rouzwelt Sep 10, 2025
5593305
update
rouzwelt Sep 10, 2025
be1d55f
update
rouzwelt Sep 10, 2025
c2cf88a
lint
rouzwelt Sep 10, 2025
e15d566
update
rouzwelt Sep 11, 2025
77f6db9
Merge branch 'main' into 2025-09-09-npm-ci
rouzwelt Sep 11, 2025
cac2268
Merge branch 'main' into 2025-09-09-npm-ci
rouzwelt Sep 15, 2025
5ff1c58
Merge branch 'main' into 2025-09-09-npm-ci
hardyjosh Sep 16, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 11 additions & 0 deletions .github/workflows/npm-package-release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -79,6 +79,17 @@ jobs:
- name: Test UI Components
run: nix develop -c npm run test -w @rainlanguage/ui-components

# check for npm package blacklists pkgs across all orderbook related packages
- uses: rainlanguage/github-chore/.github/actions/npm-blacklist@main

- uses: rainlanguage/github-chore/.github/actions/npm-blacklist@main
with:
working-directory: packages/orderbook

- uses: rainlanguage/github-chore/.github/actions/npm-blacklist@main
with:
working-directory: packages/ui-components

Comment on lines +82 to +92

@coderabbitai coderabbitai Bot Sep 15, 2025

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧹 Nitpick (assertive)

Add explicit step names for readability.

Unnamed steps make triage noisy. Give each a distinct name, e.g., “NPM blacklist (root)”, “NPM blacklist (orderbook)”, “NPM blacklist (ui-components)”.

Apply:

-      - uses: rainlanguage/github-chore/.github/actions/npm-blacklist@<commit-sha>
+      - name: NPM blacklist (root)
+        uses: rainlanguage/github-chore/.github/actions/npm-blacklist@<commit-sha>

-      - uses: rainlanguage/github-chore/.github/actions/npm-blacklist@<commit-sha>
+      - name: NPM blacklist (orderbook)
+        uses: rainlanguage/github-chore/.github/actions/npm-blacklist@<commit-sha>
         with:
           working-directory: packages/orderbook

-      - uses: rainlanguage/github-chore/.github/actions/npm-blacklist@<commit-sha>
+      - name: NPM blacklist (ui-components)
+        uses: rainlanguage/github-chore/.github/actions/npm-blacklist@<commit-sha>
         with:
           working-directory: packages/ui-components
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
# check for npm package blacklists pkgs across all orderbook related packages
- uses: rainlanguage/github-chore/.github/actions/npm-blacklist@main
- uses: rainlanguage/github-chore/.github/actions/npm-blacklist@main
with:
working-directory: packages/orderbook
- uses: rainlanguage/github-chore/.github/actions/npm-blacklist@main
with:
working-directory: packages/ui-components
# check for npm package blacklists pkgs across all orderbook related packages
- name: NPM blacklist (root)
uses: rainlanguage/github-chore/.github/actions/npm-blacklist@<commit-sha>
- name: NPM blacklist (orderbook)
uses: rainlanguage/github-chore/.github/actions/npm-blacklist@<commit-sha>
with:
working-directory: packages/orderbook
- name: NPM blacklist (ui-components)
uses: rainlanguage/github-chore/.github/actions/npm-blacklist@<commit-sha>
with:
working-directory: packages/ui-components
🤖 Prompt for AI Agents 
.github/workflows/npm-package-release.yml around lines 82 to 92: the three
workflow steps invoking
rainlanguage/github-chore/.github/actions/npm-blacklist@main are unnamed which
reduces readability; add an explicit name: field for each step (for example "NPM
blacklist (root)", "NPM blacklist (orderbook)", "NPM blacklist
(ui-components)"), leaving the uses and with: blocks intact so each step is
clearly labeled in the Actions UI.

⚠️ Potential issue

Pin the action to a commit SHA (avoid @main).

Using a moving ref is a supply‑chain risk. Pin each npm‑blacklist step to a specific commit SHA from rainlanguage/github-chore.

Apply:

-      - uses: rainlanguage/github-chore/.github/actions/npm-blacklist@main
+      - uses: rainlanguage/github-chore/.github/actions/npm-blacklist@<commit-sha>

-      - uses: rainlanguage/github-chore/.github/actions/npm-blacklist@main
+      - uses: rainlanguage/github-chore/.github/actions/npm-blacklist@<commit-sha>
         with:
           working-directory: packages/orderbook

-      - uses: rainlanguage/github-chore/.github/actions/npm-blacklist@main
+      - uses: rainlanguage/github-chore/.github/actions/npm-blacklist@<commit-sha>
         with:
           working-directory: packages/ui-components

Replace with the exact immutable digest. I can fetch and fill it in if you prefer.

🤖 Prompt for AI Agents 
.github/workflows/npm-package-release.yml lines 82-92: the workflow uses
rainlanguage/github-chore/.github/actions/npm-blacklist@main in three steps
which is a moving ref; replace each '@main' with the same specific commit SHA
(the immutable git digest) to pin the action, i.e., update the three uses lines
so they reference
rainlanguage/github-chore/.github/actions/npm-blacklist@<commit-sha> (replace
<commit-sha> with the exact SHA provided), leaving everything else in those
steps unchanged.

- name: Git Config
run: |
git config --global user.email "${{ secrets.CI_GIT_EMAIL }}"
Expand Down
15 changes: 15 additions & 0 deletions .github/workflows/tauri-release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -99,6 +99,21 @@ jobs:
COMMIT_SHA: ${{ github.sha }}
SENTRY_LOG_LEVEL: debug

# check for npm package blacklists pkgs across all tauri related packages
- uses: rainlanguage/github-chore/.github/actions/npm-blacklist@main

- uses: rainlanguage/github-chore/.github/actions/npm-blacklist@main
with:
working-directory: packages/orderbook

- uses: rainlanguage/github-chore/.github/actions/npm-blacklist@main
with:
working-directory: packages/ui-components

- uses: rainlanguage/github-chore/.github/actions/npm-blacklist@main
with:
working-directory: tauri-app

Comment on lines +102 to +116

@coderabbitai coderabbitai Bot Sep 11, 2025

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧹 Nitpick (assertive)

Confirm scope and placement of blacklist checks.

  • Scope: If the root run scans all packages, the three scoped runs may be unnecessary.
  • Placement: Consider moving these checks earlier to fail fast before costly steps.

Do you want me to refactor into a matrix or a reusable workflow and place it right after checkout?

🤖 Prompt for AI Agents 
.github/workflows/tauri-release.yml lines 102-116: the workflow runs the same
npm-blacklist action four times (root + three package-specific invocations) and
they are placed late in the job; either the root scan already covers all
packages (making the scoped runs redundant) or we should run per-package checks
earlier to fail fast. Refactor by replacing the repeated steps with a single
matrix (or call a reusable workflow) that iterates over the desired
working-directory values (including root and each package) and move that
job/step immediately after the checkout step so blacklist checks run first; if
the root scan truly covers all packages, remove the scoped invocations instead
of duplicating them.

- uses: tauri-apps/tauri-action@v0
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
Expand Down
15 changes: 15 additions & 0 deletions .github/workflows/tauri.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -98,3 +98,18 @@ jobs:
- run: rm -rf tauri-app/src-tauri/target/debug tauri-app/src-tauri/target/release

- run: nix develop .#tauri-shell --command tauri-rs-test

# check for npm package blacklists pkgs across all tauri related packages
- uses: rainlanguage/github-chore/.github/actions/npm-blacklist@main

- uses: rainlanguage/github-chore/.github/actions/npm-blacklist@main
with:
working-directory: packages/orderbook

- uses: rainlanguage/github-chore/.github/actions/npm-blacklist@main
with:
working-directory: packages/ui-components

- uses: rainlanguage/github-chore/.github/actions/npm-blacklist@main
with:
working-directory: tauri-app
18 changes: 14 additions & 4 deletions .github/workflows/test-ui-components.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,7 +44,17 @@ jobs:
env:
PUBLIC_WALLETCONNECT_PROJECT_ID: ${{ secrets.WALLETCONNECT_PROJECT_ID || 'test' }}

- run: nix develop -c npm run svelte-lint-format-check
working-directory: packages/ui-components
- run: nix develop -c npm run test
working-directory: packages/ui-components
- run: nix develop -c npm run svelte-lint-format-check -w @rainlanguage/ui-components

- run: nix develop -c npm run test -w @rainlanguage/ui-components
Comment thread
rouzwelt marked this conversation as resolved.

# check for npm package blacklists pkgs across all packages
- uses: rainlanguage/github-chore/.github/actions/npm-blacklist@main

- uses: rainlanguage/github-chore/.github/actions/npm-blacklist@main
with:
working-directory: packages/orderbook

- uses: rainlanguage/github-chore/.github/actions/npm-blacklist@main
with:
working-directory: packages/ui-components
21 changes: 17 additions & 4 deletions .github/workflows/test-webapp.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,12 +44,25 @@ jobs:
env:
PUBLIC_WALLETCONNECT_PROJECT_ID: ${{ secrets.WALLETCONNECT_PROJECT_ID || 'test' }}

- run: nix develop -c npm run svelte-lint-format-check
working-directory: packages/webapp
- run: nix develop -c npm run svelte-lint-format-check -w @rainlanguage/webapp
env:
PUBLIC_WALLETCONNECT_PROJECT_ID: ${{ secrets.WALLETCONNECT_PROJECT_ID || 'test' }}

- run: nix develop -c npm run test
working-directory: packages/webapp
- run: nix develop -c npm run test -w @rainlanguage/webapp
env:
PUBLIC_WALLETCONNECT_PROJECT_ID: ${{ secrets.WALLETCONNECT_PROJECT_ID || 'test' }}
Comment on lines +47 to 53

@coderabbitai coderabbitai Bot Sep 11, 2025

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧹 Nitpick (assertive)

Use canonical npm workspace flag position.

Place -w before run to avoid any npm option parsing ambiguity.

-      - run: nix develop -c npm run svelte-lint-format-check -w @rainlanguage/webapp
+      - run: nix develop -c npm -w @rainlanguage/webapp run svelte-lint-format-check
@@
-      - run: nix develop -c npm run test -w @rainlanguage/webapp
+      - run: nix develop -c npm -w @rainlanguage/webapp run test
🤖 Prompt for AI Agents 
.github/workflows/test-webapp.yaml around lines 47 to 53: the npm workspace flag
(-w) is currently placed after "run" which can cause option parsing ambiguity;
move the -w flag before "run" for both npm commands (e.g., "npm -w
@rainlanguage/webapp run ...") so the workspace is recognized unambiguously by
npm, and keep the same env entries unchanged.


Comment thread
rouzwelt marked this conversation as resolved.
# check for npm package blacklists pkgs across all packages
- uses: rainlanguage/github-chore/.github/actions/npm-blacklist@main

- uses: rainlanguage/github-chore/.github/actions/npm-blacklist@main
with:
working-directory: packages/orderbook

- uses: rainlanguage/github-chore/.github/actions/npm-blacklist@main
with:
working-directory: packages/ui-components

- uses: rainlanguage/github-chore/.github/actions/npm-blacklist@main
with:
working-directory: packages/webapp
Comment on lines +55 to +68

@coderabbitai coderabbitai Bot Sep 11, 2025

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧹 Nitpick (assertive)

Deduplicate blacklist runs or use a matrix.

Same as other workflows: keep only root if it’s recursive, or matrix-ize.

🤖 Prompt for AI Agents 
.github/workflows/test-webapp.yaml lines 55-68: the npm-blacklist action is
invoked four times (root plus three package-specific calls) which duplicates
work; either keep only the root invocation if that action checks subdirectories
recursively or replace the repeated steps with a single matrix/looped job that
runs the action once per working-directory (packages/orderbook,
packages/ui-components, packages/webapp) — update the workflow to remove
duplicate steps and implement a matrix strategy (or confirm recursive behavior
and delete the per-package entries) so each package is checked exactly once.

11 changes: 11 additions & 0 deletions .github/workflows/vercel-preview-pr-target.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -59,6 +59,17 @@ jobs:
env:
PUBLIC_WALLETCONNECT_PROJECT_ID: test

# check for npm package blacklists pkgs across all packages
- uses: rainlanguage/github-chore/.github/actions/npm-blacklist@main

- uses: rainlanguage/github-chore/.github/actions/npm-blacklist@main
with:
working-directory: packages/orderbook

- uses: rainlanguage/github-chore/.github/actions/npm-blacklist@main
with:
working-directory: packages/ui-components

Comment on lines +62 to +72

@coderabbitai coderabbitai Bot Sep 11, 2025

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧹 Nitpick (assertive)

Fail fast: run blacklist before the build step.

Move blacklist ahead of the build to abort earlier on violations.

🤖 Prompt for AI Agents 
.github/workflows/vercel-preview-pr-target.yaml lines 62-72: the npm-blacklist
checks run after the build; move the three uses of
rainlanguage/github-chore/.github/actions/npm-blacklist@main (root and the two
with working-directory: packages/orderbook and packages/ui-components) to a
point in the job before the build step so the workflow fails fast on blacklist
violations; ensure you preserve their inputs and relative ordering and update
any step dependencies if the build previously depended on them.

- name: Install Vercel CLI (local, pinned)
shell: bash --noprofile --norc -euo pipefail {0}
run: |
Expand Down
11 changes: 11 additions & 0 deletions .github/workflows/vercel-preview.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -63,6 +63,17 @@ jobs:
env:
PUBLIC_WALLETCONNECT_PROJECT_ID: ${{ secrets.WALLETCONNECT_PROJECT_ID }}

# check for npm package blacklists pkgs across all packages

@coderabbitai coderabbitai Bot Sep 11, 2025

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧹 Nitpick (assertive)

Fail fast: move blacklist checks before the build.

Place blacklist steps before the webapp build to save CI time when a blocklist hit would fail anyway.

🤖 Prompt for AI Agents 
.github/workflows/vercel-preview.yaml around line 66: the blacklist/npm package
check step currently runs after the webapp build, wasting CI cycles when a
blocklisted package would fail the job; move the blacklist check steps to run
before the webapp build step (place them earlier in the job sequence or in a
separate pre-build job/step that runs on the same runner), ensure their
outputs/exit codes still fail the workflow on detection, and update any step
dependencies (needs/if conditions) so the build depends on the blacklist step
passing.

🧹 Nitpick (assertive)

Nit: fix comment wording.

Use “Check npm package blacklist across all workspaces.”

-      # check for npm package blacklists pkgs across all packages
+      # Check npm package blacklist across all workspaces
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
# check for npm package blacklists pkgs across all packages
# Check npm package blacklist across all workspaces
🤖 Prompt for AI Agents 
.github/workflows/vercel-preview.yaml around line 66: the comment currently
reads "check for npm package blacklists pkgs across all packages" which is
unclear and grammatically off; replace it with "Check npm package blacklist
across all workspaces." to match style and clarity.

- uses: rainlanguage/github-chore/.github/actions/npm-blacklist@main

- uses: rainlanguage/github-chore/.github/actions/npm-blacklist@main
with:
working-directory: packages/orderbook

- uses: rainlanguage/github-chore/.github/actions/npm-blacklist@main
with:
working-directory: packages/ui-components

- name: Install Vercel CLI (local, pinned)
shell: bash --noprofile --norc -euo pipefail {0}
run: |
Expand Down
11 changes: 11 additions & 0 deletions .github/workflows/vercel-prod.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -46,6 +46,17 @@ jobs:
env:
PUBLIC_WALLETCONNECT_PROJECT_ID: ${{ secrets.WALLETCONNECT_PROJECT_ID }}

# check for npm package blacklists pkgs across all packages
- uses: rainlanguage/github-chore/.github/actions/npm-blacklist@main

- uses: rainlanguage/github-chore/.github/actions/npm-blacklist@main
with:
working-directory: packages/orderbook

- uses: rainlanguage/github-chore/.github/actions/npm-blacklist@main
with:
working-directory: packages/ui-components

Comment on lines +49 to +59

@coderabbitai coderabbitai Bot Sep 11, 2025

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧹 Nitpick (assertive)

Fail fast: run blacklist before build.

Move blacklist steps before packages/webapp build to avoid wasted cycles on failures.

🤖 Prompt for AI Agents 
.github/workflows/vercel-prod.yaml around lines 49-59: the npm-blacklist steps
currently run after the packages/webapp build causing wasted work on failures;
move the three npm-blacklist steps (root, packages/orderbook,
packages/ui-components) to run before the packages/webapp build step in the
job's steps sequence so they execute and can fail-fast, preserving their with:
working-directory settings and any required names or uses, and ensure any step
that depends on blacklist results still runs after them.

- name: Install Vercel CLI
run: npm install --global vercel@canary
- name: Pull Vercel Environment Information
Expand Down
6 changes: 3 additions & 3 deletions flake.lock
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.