3f68377c3d
In order to keep integration tests on CI as determinitstic as possible, we need to ensure that the same dependencies (including transitive ones) are installed each time. One way to ensure that is using a lockfile (such as `yarn.lock`) to pin the dependencies to exact versions. This works as long as the lockfile itself is in-sync with the corresponding `package.json`, which specifies the dependencies. Ideally, we would run `yarn install` with the `--frozen-lockfile` option to verify that the lockfile is in-sync with `package.json`, but we cannot do that for integration projects, because we want to be able to install the locally built Angular packages). Therefore, we must manually esnure that the integration project lockfiles remain in-sync, which is error-prone. This commit introduces a helper script that performs some checks on each project's (non-local) dependencies: - Ensure that exact versions (not version ranges) are specified in `package.json`. This reduces the probability of installing a breaking version of a direct or transitive dependency, in case of an out-of-sync lockfile. - Ensure that the lockfile is in-sync with `package.json` wrt these dependencies. While these checks are not full-proof, they provide yet another line of defense against indeterminism. PR Close #33968
80 lines
3.5 KiB
JavaScript
Executable File
80 lines
3.5 KiB
JavaScript
Executable File
#!/usr/bin/env node
|
|
|
|
/**
|
|
* **Usage:**
|
|
* ```
|
|
* node check-depenencies <project-directory-path>
|
|
* ```
|
|
*
|
|
* Checks the non-local dependencies of the specified project and ensures that:
|
|
* - Exact versions (not version ranges) are specified in the project's `package.json`.
|
|
* This reduces the probability of installing a breaking version of a direct or transitive
|
|
* dependency, in case of an out-of-sync lockfile.
|
|
* - The project's lockfile (`yarn.lock`) is in-sync with `package.json` wrt these dependencies.
|
|
*
|
|
* If any of the above checks fails, the script will throw an error, otherwise it will complete
|
|
* successfully.
|
|
*
|
|
* **Context:**
|
|
* In order to keep integration tests on CI as determinitstic as possible, we need to ensure that
|
|
* the same dependencies (including transitive ones) are installed each time. One way to ensure that
|
|
* is using a lockfile (such as `yarn.lock`) to pin the dependencies to exact versions. This works
|
|
* as long as the lockfile itself is in-sync with the corresponding `package.json`, which specifies
|
|
* the dependencies.
|
|
*
|
|
* Ideally, we would run `yarn install` with the `--frozen-lockfile` option to verify that the
|
|
* lockfile is in-sync with `package.json`, but we cannot do that for integration projects, because
|
|
* we want to be able to install the locally built Angular packages). Therefore, we must manually
|
|
* esnure that the integration project lockfiles remain in-sync, which is error-prone.
|
|
*
|
|
* The checks performed by this script (although not full-proof) provide another line of defense
|
|
* against indeterminism caused by unpinned dependencies.
|
|
*/
|
|
'use strict';
|
|
|
|
const {parse: parseLockfile} = require('@yarnpkg/lockfile');
|
|
const {readFileSync} = require('fs');
|
|
const {resolve: resolvePath} = require('path');
|
|
|
|
const projectDir = resolvePath(process.argv[2]);
|
|
const pkgJsonPath = `${projectDir}/package.json`;
|
|
const lockfilePath = `${projectDir}/yarn.lock`;
|
|
|
|
console.log(`Checking dependencies for '${projectDir}'...`);
|
|
|
|
// Collect non-local dependencies (in `[name, version]` pairs).
|
|
// (Also ingore `git+https:` dependencies, because checking them is not straight-forward.)
|
|
const pkgJson = JSON.parse(readFileSync(pkgJsonPath, 'utf8'));
|
|
const deps = [
|
|
...Object.entries(pkgJson.dependencies || {}),
|
|
...Object.entries(pkgJson.devDependencies || {}),
|
|
].filter(([, version]) => !/^(?:file|git\+https):/.test(version));
|
|
|
|
// Check for dependencies with non-exact versions.
|
|
const nonExactDeps = deps.filter(([, version]) => !/^\d+\.\d+\.\d+(?:-\w+\.\d+)?$/.test(version));
|
|
|
|
if (nonExactDeps.length) {
|
|
throw new Error(
|
|
`The following dependencies in '${projectDir}' are not pinned to exact versions (of the ` +
|
|
'format X.Y.Z[-<pre-release-identifier>]):' +
|
|
nonExactDeps.map(([name, version]) => `\n ${name}: ${version}`));
|
|
}
|
|
|
|
// Check for dependencies that are not in-sync between `package.json` and the lockfile.
|
|
const {object: parsedLockfile} = parseLockfile(readFileSync(lockfilePath, 'utf8'));
|
|
const outOfSyncDeps = deps
|
|
.map(([depName, pkgJsonVersion]) => [
|
|
depName,
|
|
pkgJsonVersion,
|
|
(parsedLockfile[`${depName}@${pkgJsonVersion}`] || {}).version,
|
|
])
|
|
.filter(([, pkgJsonVersion, lockfileVersion]) => pkgJsonVersion !== lockfileVersion);
|
|
|
|
if (outOfSyncDeps.length) {
|
|
throw new Error(
|
|
`The following dependencies in '${projectDir}' are out-of-sync between 'package.json' and ` +
|
|
'the lockfile:' +
|
|
outOfSyncDeps.map(([name, pkgJsonVersion, lockfileVersion]) =>
|
|
`\n ${name}: ${pkgJsonVersion} vs ${lockfileVersion}`));
|
|
}
|