mirror of
https://github.com/Twigpine/node.git
synced 2026-11-10 05:01:48 -10:00
t
ebfe89d1c9
sync-release-lock ran cargo update --workspace on whatever Rust the ubuntu-latest image shipped, so the lock it wrote for the release PR came off an undeclared input. Install the same stable toolchain the other cargo jobs use. This does not make resolution identical (stable moves, and the MSRV gate checks the same lock on 1.91), it just removes the runner image from the equation. The release-binaries build, both Dockerfiles and the darwin path of build-bins.sh also resolved without --locked, so a lockfile disagreeing with the manifests was caught on the PR gates but not where artifacts are actually produced. Add --locked to all five. Two of those five cannot reach resolution today and are hardened for when they can: the Dockerfile dep-cache layer at line 24 copies four of the workspace's six member manifests, so cargo dies at workspace load and || true swallows it, and Dockerfile.bins pins rust:1.85 against a 1.91 MSRV. Both are pre-existing and left alone here. The live coverage comes from release.yml, Dockerfile:37 and build-bins.sh. The gitlawb-core dependency-purity gate still resolves without --locked on purpose, but its comment justified that by saying the build and test jobs do the same, which stopped being true when those jobs gained --locked. Restate the real reason: a stale lock would red that gate for something unrelated to the dependency closure it checks.
76 lines
3.0 KiB
Bash
Executable File
76 lines
3.0 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
#
|
|
# Dependency-purity gate for the `gitlawb-core` crate.
|
|
#
|
|
# gitlawb-core is embedded by every consumer (the gl CLI, git-remote-gitlawb,
|
|
# the node daemon), so it must stay lean. This script recomputes gitlawb-core's
|
|
# NORMAL (non-dev, non-build) transitive dependency set and fails if it contains
|
|
# any crate not present in ci/gitlawb-core-allowed-deps.txt.
|
|
#
|
|
# Hard-fail direction: a crate present now but NOT allowlisted. That is the case
|
|
# the gate exists to catch (core silently gaining a heavy dependency).
|
|
# Informational only: an allowlisted crate no longer present (stale entry) — a
|
|
# legitimate dependency removal should not red CI, so it is reported, not failed.
|
|
#
|
|
# Runnable from anywhere in the repo.
|
|
set -euo pipefail
|
|
|
|
ROOT="$(git rev-parse --show-toplevel)"
|
|
ALLOW="$ROOT/ci/gitlawb-core-allowed-deps.txt"
|
|
|
|
if [ ! -f "$ALLOW" ]; then
|
|
echo "ERROR: allowlist not found at $ALLOW" >&2
|
|
exit 1
|
|
fi
|
|
|
|
# `cargo tree` resolves WITHOUT --locked on purpose, unlike the blocking cargo
|
|
# jobs in pr-checks. This gate answers one question, whether gitlawb-core's
|
|
# dependency closure gained something unallowlisted, and a stale Cargo.lock
|
|
# would red it for a reason that has nothing to do with that closure. Lock
|
|
# staleness is already caught by the --locked cargo jobs, so it does not need a
|
|
# second gate here.
|
|
#
|
|
# Resolving can refresh Cargo.lock as a side effect, so snapshot and restore
|
|
# it: this check must never leave the working tree dirty when run locally.
|
|
lock_backup="$(mktemp)"
|
|
cp "$ROOT/Cargo.lock" "$lock_backup"
|
|
restore_lock() { cp "$lock_backup" "$ROOT/Cargo.lock"; rm -f "$lock_backup"; }
|
|
trap restore_lock EXIT
|
|
|
|
# Current normal-dependency closure of gitlawb-core, one crate name per line.
|
|
# Must match the regen command documented in the allowlist header exactly.
|
|
current="$(
|
|
cargo tree -p gitlawb-core --edges normal --prefix none --manifest-path "$ROOT/Cargo.toml" \
|
|
| sed -E 's/ v[0-9].*$//' \
|
|
| grep -v '^gitlawb-core$' \
|
|
| sort -u
|
|
)"
|
|
|
|
# Allowlist with comments and blank lines stripped.
|
|
allowed="$(grep -vE '^[[:space:]]*(#|$)' "$ALLOW" | sort -u)"
|
|
|
|
# comm needs sorted input; both sides are sorted above.
|
|
offenders="$(comm -23 <(printf '%s\n' "$current") <(printf '%s\n' "$allowed"))"
|
|
stale="$(comm -13 <(printf '%s\n' "$current") <(printf '%s\n' "$allowed"))"
|
|
|
|
if [ -n "$stale" ]; then
|
|
echo "NOTE: allowlisted crates no longer in gitlawb-core's dependency tree"
|
|
echo " (safe to prune from ci/gitlawb-core-allowed-deps.txt):"
|
|
printf ' %s\n' $stale
|
|
echo
|
|
fi
|
|
|
|
if [ -n "$offenders" ]; then
|
|
{
|
|
echo "ERROR: gitlawb-core gained dependencies not on the allowlist:"
|
|
printf ' %s\n' $offenders
|
|
echo
|
|
echo "gitlawb-core must stay embeddable and lean. If a new dependency is"
|
|
echo "intentional, add it to ci/gitlawb-core-allowed-deps.txt (regen command"
|
|
echo "is in that file's header). Otherwise, drop the dependency."
|
|
} >&2
|
|
exit 1
|
|
fi
|
|
|
|
echo "gitlawb-core dependency purity: OK ($(printf '%s\n' "$current" | wc -l | tr -d ' ') normal deps, all allowlisted)."
|