Skip to content

Commit aa242b7

Browse files
jdaltonjdalton
committed
fix: pnpm v11 CI compatibility for npm package tests
- Write overrides to pnpm-workspace.yaml (not package.json pnpm.overrides) because pnpm v11 RC ignores npm: alias overrides in package.json for subdeps - Add resolution-mode=highest (SFW proxy strips time field from registry metadata) - Add confirmModulesPurge=false (prevent interactive prompts) - Add block-exotic-subdeps=false for test installs (third-party git deps) - Add strict-dep-builds=false for test installs (third-party build scripts) - Reduce install concurrency to 3 (pnpm v11 store corruption at high parallelism) - Add is-unicode-supported to allowed failures (pnpm/pnpm#11238) - Add is-unicode-supported unit tests (ported 1:1 from upstream v2.1.0)
1 parent 5342caa commit aa242b7

3 files changed

Lines changed: 89 additions & 55 deletions

File tree

‎.claude/hooks/setup-security-tools/external-tools.json‎

Lines changed: 63 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -5,58 +5,85 @@
55
"description": "GitHub Actions security scanner",
66
"version": "1.23.1",
77
"repository": "github:zizmorcore/zizmor",
8-
"assets": {
9-
"darwin-arm64": "zizmor-aarch64-apple-darwin.tar.gz",
10-
"darwin-x64": "zizmor-x86_64-apple-darwin.tar.gz",
11-
"linux-arm64": "zizmor-aarch64-unknown-linux-gnu.tar.gz",
12-
"linux-x64": "zizmor-x86_64-unknown-linux-gnu.tar.gz",
13-
"win-x64": "zizmor-x86_64-pc-windows-msvc.zip"
14-
},
8+
"release": "asset",
159
"checksums": {
16-
"zizmor-aarch64-apple-darwin.tar.gz": "2632561b974c69f952258c1ab4b7432d5c7f92e555704155c3ac28a2910bd717",
17-
"zizmor-aarch64-unknown-linux-gnu.tar.gz": "3725d7cd7102e4d70827186389f7d5930b6878232930d0a3eb058d7e5b47e658",
18-
"zizmor-x86_64-apple-darwin.tar.gz": "89d5ed42081dd9d0433a10b7545fac42b35f1f030885c278b9712b32c66f2597",
19-
"zizmor-x86_64-pc-windows-msvc.zip": "33c2293ff02834720dd7cd8b47348aafb2e95a19bdc993c0ecaca9c804ade92a",
20-
"zizmor-x86_64-unknown-linux-gnu.tar.gz": "67a8df0a14352dd81882e14876653d097b99b0f4f6b6fe798edc0320cff27aff"
10+
"darwin-arm64": {
11+
"asset": "zizmor-aarch64-apple-darwin.tar.gz",
12+
"sha256": "2632561b974c69f952258c1ab4b7432d5c7f92e555704155c3ac28a2910bd717"
13+
},
14+
"darwin-x64": {
15+
"asset": "zizmor-x86_64-apple-darwin.tar.gz",
16+
"sha256": "89d5ed42081dd9d0433a10b7545fac42b35f1f030885c278b9712b32c66f2597"
17+
},
18+
"linux-arm64": {
19+
"asset": "zizmor-aarch64-unknown-linux-gnu.tar.gz",
20+
"sha256": "3725d7cd7102e4d70827186389f7d5930b6878232930d0a3eb058d7e5b47e658"
21+
},
22+
"linux-x64": {
23+
"asset": "zizmor-x86_64-unknown-linux-gnu.tar.gz",
24+
"sha256": "67a8df0a14352dd81882e14876653d097b99b0f4f6b6fe798edc0320cff27aff"
25+
},
26+
"win-x64": {
27+
"asset": "zizmor-x86_64-pc-windows-msvc.zip",
28+
"sha256": "33c2293ff02834720dd7cd8b47348aafb2e95a19bdc993c0ecaca9c804ade92a"
29+
}
2130
}
2231
},
2332
"sfw-free": {
2433
"description": "Socket Firewall (free tier)",
2534
"version": "v1.6.1",
2635
"repository": "github:SocketDev/sfw-free",
27-
"platforms": {
28-
"darwin-arm64": "macos-arm64",
29-
"darwin-x64": "macos-x86_64",
30-
"linux-arm64": "linux-arm64",
31-
"linux-x64": "linux-x86_64",
32-
"win-x64": "windows-x86_64"
33-
},
36+
"release": "asset",
3437
"checksums": {
35-
"linux-arm64": "df2eedb2daf2572eee047adb8bfd81c9069edcb200fc7d3710fca98ec3ca81a1",
36-
"linux-x86_64": "4a1e8b65e90fce7d5fd066cf0af6c93d512065fa4222a475c8d959a6bc14b9ff",
37-
"macos-arm64": "bf1616fc44ac49f1cb2067fedfa127a3ae65d6ec6d634efbb3098cfa355e5555",
38-
"macos-x86_64": "724ccea19d847b79db8cc8e38f5f18ce2dd32336007f42b11bed7d2e5f4a2566",
39-
"windows-x86_64": "c953e62ad7928d4d8f2302f5737884ea1a757babc26bed6a42b9b6b68a5d54af"
38+
"darwin-arm64": {
39+
"asset": "sfw-free-macos-arm64",
40+
"sha256": "bf1616fc44ac49f1cb2067fedfa127a3ae65d6ec6d634efbb3098cfa355e5555"
41+
},
42+
"darwin-x64": {
43+
"asset": "sfw-free-macos-x86_64",
44+
"sha256": "724ccea19d847b79db8cc8e38f5f18ce2dd32336007f42b11bed7d2e5f4a2566"
45+
},
46+
"linux-arm64": {
47+
"asset": "sfw-free-linux-arm64",
48+
"sha256": "df2eedb2daf2572eee047adb8bfd81c9069edcb200fc7d3710fca98ec3ca81a1"
49+
},
50+
"linux-x64": {
51+
"asset": "sfw-free-linux-x86_64",
52+
"sha256": "4a1e8b65e90fce7d5fd066cf0af6c93d512065fa4222a475c8d959a6bc14b9ff"
53+
},
54+
"win-x64": {
55+
"asset": "sfw-free-windows-x86_64.exe",
56+
"sha256": "c953e62ad7928d4d8f2302f5737884ea1a757babc26bed6a42b9b6b68a5d54af"
57+
}
4058
},
4159
"ecosystems": ["npm", "yarn", "pnpm", "pip", "uv", "cargo"]
4260
},
4361
"sfw-enterprise": {
4462
"description": "Socket Firewall (enterprise tier)",
4563
"version": "v1.6.1",
4664
"repository": "github:SocketDev/firewall-release",
47-
"platforms": {
48-
"darwin-arm64": "macos-arm64",
49-
"darwin-x64": "macos-x86_64",
50-
"linux-arm64": "linux-arm64",
51-
"linux-x64": "linux-x86_64",
52-
"win-x64": "windows-x86_64"
53-
},
65+
"release": "asset",
5466
"checksums": {
55-
"linux-arm64": "671270231617142404a1564e52672f79b806f9df3f232fcc7606329c0246da55",
56-
"linux-x86_64": "9115b4ca8021eb173eb9e9c3627deb7f1066f8debd48c5c9d9f3caabb2a26a4b",
57-
"macos-arm64": "acad0b517601bb7408e2e611c9226f47dcccbd83333d7fc5157f1d32ed2b953d",
58-
"macos-x86_64": "01d64d40effda35c31f8d8ee1fed1388aac0a11aba40d47fba8a36024b77500c",
59-
"windows-x86_64": "9a50e1ddaf038138c3f85418dc5df0113bbe6fc884f5abe158beaa9aea18d70a"
67+
"darwin-arm64": {
68+
"asset": "sfw-macos-arm64",
69+
"sha256": "acad0b517601bb7408e2e611c9226f47dcccbd83333d7fc5157f1d32ed2b953d"
70+
},
71+
"darwin-x64": {
72+
"asset": "sfw-macos-x86_64",
73+
"sha256": "01d64d40effda35c31f8d8ee1fed1388aac0a11aba40d47fba8a36024b77500c"
74+
},
75+
"linux-arm64": {
76+
"asset": "sfw-linux-arm64",
77+
"sha256": "671270231617142404a1564e52672f79b806f9df3f232fcc7606329c0246da55"
78+
},
79+
"linux-x64": {
80+
"asset": "sfw-linux-x86_64",
81+
"sha256": "9115b4ca8021eb173eb9e9c3627deb7f1066f8debd48c5c9d9f3caabb2a26a4b"
82+
},
83+
"win-x64": {
84+
"asset": "sfw-windows-x86_64.exe",
85+
"sha256": "9a50e1ddaf038138c3f85418dc5df0113bbe6fc884f5abe158beaa9aea18d70a"
86+
}
6087
},
6188
"ecosystems": ["npm", "yarn", "pnpm", "pip", "uv", "cargo", "gem", "bundler", "nuget"]
6289
}

‎.claude/hooks/setup-security-tools/index.mts‎

Lines changed: 14 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -122,11 +122,13 @@ async function setupZizmor(): Promise<boolean> {
122122

123123
// Download archive via dlx (handles caching + checksum).
124124
const platformKey = `${process.platform === 'win32' ? 'win' : process.platform}-${process.arch}`
125-
const asset = ZIZMOR.assets?.[platformKey]
126-
if (!asset) throw new Error(`Unsupported platform: ${platformKey}`)
127-
const expectedSha = ZIZMOR.checksums?.[asset]
128-
if (!expectedSha) throw new Error(`No checksum for: ${asset}`)
129-
const url = `https://github.com/${ZIZMOR.repository}/releases/download/v${ZIZMOR.version}/${asset}`
125+
const platformEntry = ZIZMOR.checksums?.[platformKey]
126+
if (!platformEntry) {
127+
throw new Error(`Unsupported platform: ${platformKey}`)
128+
}
129+
const { asset, sha256: expectedSha } = platformEntry
130+
const repo = ZIZMOR.repository?.replace(/^github:/, '') ?? ''
131+
const url = `https://github.com/${repo}/releases/download/v${ZIZMOR.version}/${asset}`
130132

131133
logger.log(`Downloading zizmor v${ZIZMOR.version} (${asset})...`)
132134
const { binaryPath: archivePath, downloaded } = await downloadBinary({
@@ -175,16 +177,15 @@ async function setupSfw(apiKey: string | undefined): Promise<boolean> {
175177

176178
// Platform.
177179
const platformKey = `${process.platform === 'win32' ? 'win' : process.platform}-${process.arch}`
178-
const sfwPlatform = sfwConfig.platforms?.[platformKey]
179-
if (!sfwPlatform) throw new Error(`Unsupported platform: ${platformKey}`)
180+
const platformEntry = sfwConfig.checksums?.[platformKey]
181+
if (!platformEntry) {
182+
throw new Error(`Unsupported platform: ${platformKey}`)
183+
}
180184

181185
// Checksum + asset.
182-
const sha256 = sfwConfig.checksums?.[sfwPlatform]
183-
if (!sha256) throw new Error(`No checksum for: ${sfwPlatform}`)
184-
const prefix = isEnterprise ? 'sfw' : 'sfw-free'
185-
const suffix = sfwPlatform.startsWith('windows') ? '.exe' : ''
186-
const asset = `${prefix}-${sfwPlatform}${suffix}`
187-
const url = `https://github.com/${sfwConfig.repository}/releases/download/${sfwConfig.version}/${asset}`
186+
const { asset, sha256 } = platformEntry
187+
const repo = sfwConfig.repository?.replace(/^github:/, '') ?? ''
188+
const url = `https://github.com/${repo}/releases/download/${sfwConfig.version}/${asset}`
188189
const binaryName = isEnterprise ? 'sfw' : 'sfw-free'
189190

190191
// Download (with cache + checksum).

‎scripts/npm/install-npm-packages.mjs‎

Lines changed: 12 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -742,7 +742,6 @@ async function installPackage(packageInfo) {
742742
}
743743

744744
// Create package.json with the original package as a dependency.
745-
// Use the appropriate override format for the detected package manager.
746745
const testPkgJson = {
747746
name: 'test-temp',
748747
private: true,
@@ -752,11 +751,18 @@ async function installPackage(packageInfo) {
752751
},
753752
}
754753

755-
// Add overrides in the appropriate format for the package manager.
756-
if (packageManager === 'pnpm') {
757-
testPkgJson.pnpm = {
758-
overrides: pnpmOverrides,
759-
}
754+
// pnpm v11 ignores overrides in package.json pnpm.overrides for subdependencies
755+
// (regression from v10). Overrides in pnpm-workspace.yaml still work.
756+
// Write overrides to pnpm-workspace.yaml for pnpm, or package.json for npm.
757+
if (packageManager === 'pnpm' && Object.keys(pnpmOverrides).length > 0) {
758+
const overrideLines = Object.entries(pnpmOverrides)
759+
.map(([pkg, spec]) => ` ${pkg}: '${spec}'`)
760+
.join('\n')
761+
await fs.writeFile(
762+
path.join(packageTempDir, 'pnpm-workspace.yaml'),
763+
`packages:\n - .\n\noverrides:\n${overrideLines}\n`,
764+
'utf8',
765+
)
760766
} else if (packageManager === 'npm') {
761767
testPkgJson.overrides = pnpmOverrides
762768
}

0 commit comments

Comments
 (0)