build(reproducibility): restack deterministic npm toolchain - #91
Conversation
|
Warning Review limit reached
Next review available in: 50 minutes You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (6)
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
📝 WalkthroughWalkthroughNode.js/npm 버전과 install script 권한을 고정했습니다. lockfile 변경 제어 모듈과 경계 테스트를 추가했습니다. CI는 정확한 base/head와 lockfile 정책을 검증하고 base drift를 거부합니다. Changes패키지 무결성 제어
Estimated code review effort: 4 (Complex) | ~60 minutes Possibly related issues
Possibly related PRs
Sequence Diagram(s)sequenceDiagram
participant PullRequest
participant GitHubActions
participant GitHubGraphQL
participant LockfileControl
PullRequest->>GitHubActions: PR head SHA와 base SHA 제공
GitHubActions->>GitHubGraphQL: live base 커밋 조회
GitHubGraphQL-->>GitHubActions: 현재 base SHA 반환
GitHubActions->>LockfileControl: base lockfile, head lockfile, policy 전달
LockfileControl-->>GitHubActions: lockfile 변경 검증 결과 반환
GitHubActions->>GitHubGraphQL: 설치 및 release 검증 후 base 재조회
GitHubGraphQL-->>GitHubActions: 최신 base SHA 반환
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches 💡 1🛠️ Fix failing CI checks 💡
📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![github-code-quality[bot]](https://avatars.githubusercontent.com/u/9919?s=60&v=4){kind=small}
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (1)
test/package-manager-review-contract.test.ts (1)
86-104: 🎯 Functional Correctness | 🔵 Trivial | ⚡ Quick win
node-version탐지 패턴이 따옴표 형식에 의존합니다.정규식
/node-version:\s*"([^"]+)"/g는 큰따옴표 값만 찾습니다. 어떤 workflow가node-version: 24또는node-version: '24.19.0'으로 선언하면declaredVersions가 비고, 테스트는 "버전 불일치"가 아니라 "선언 없음"으로 실패합니다. 실패 원인이 실제 계약 위반과 달라집니다. 따옴표 유무와 종류를 모두 허용하도록 패턴을 넓히십시오.♻️ 제안 변경
const declaredVersions = [ - ...workflow.matchAll(/node-version:\s*"([^"]+)"/g), - ].map((match) => match[1]); + ...workflow.matchAll(/node-version:\s*(?:"([^"]+)"|'([^']+)'|([^\s#]+))/g), + ].map((match) => match[1] ?? match[2] ?? match[3]);🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@test/package-manager-review-contract.test.ts` around lines 86 - 104, Update the node-version detection regex in the test “validates every declared workflow Node version instead of only the first match” to capture unquoted, single-quoted, and double-quoted values. Preserve global matching and ensure declaredVersions contains each workflow declaration so invalid versions fail the version assertion rather than the no-declarations check.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@test/package-manager-review-contract.test.ts`:
- Around line 86-104: Update the node-version detection regex in the test
“validates every declared workflow Node version instead of only the first match”
to capture unquoted, single-quoted, and double-quoted values. Preserve global
matching and ensure declaredVersions contains each workflow declaration so
invalid versions fail the version assertion rather than the no-declarations
check.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: fce98e26-e6c5-446e-af42-c160f386f5c6
📒 Files selected for processing (5)
CHANGELOG.mddocs/doctoring/package-manager-reproducibility.mdscripts/lockfile-change-control.mjstest/lockfile-change-control-versioned-policy.test.tstest/package-manager-review-contract.test.ts
🚧 Files skipped from review as they are similar to previous changes (1)
- CHANGELOG.md
1 participant
Purpose
Clean protected-main successor to superseded #89 after #76 integrated. This branch starts from protected
mainc85d710804139c0697d7ef8fa47d02b1389e6d84and replays only #89's unique package-manager/reproducibility delta; predecessor checks/reviews do not transfer.Exact preservation proof
Fresh comparison of #76's exact predecessor head
e0106ce16b7b8b493f46bf075ec5baf58762bd95to #89 headadcc42d2b0fec3106faabb59bbf7e79124714f7aidentified exactly 17 unique files. Fresh comparison of protectedmainto this replacement branch identifies the same 17 paths with the same per-file additions/deletions. Each replacement file was populated from #89's exact current-head content; #76's already-integrated lockfile, reviewer CI, nanoid doctoring, exact-head CI contract and changelog remediation are inherited from protected main rather than replayed.Unique paths are:
.github/workflows/ci.yml.npmrcCHANGELOG.mddocs/doctoring/package-manager-reproducibility.mdpackage.jsonscripts/lockfile-change-control.mjstest/workflow-readiness.test.tsvitest.config.tsImplemented boundary
24.19.0/ npm11.17.0development and lockfile toolchain;strict-allow-scripts=truewith exact reviewed install-script identities and an explicit deny forfsevents@2.3.3;scripts/lockfile-change-control.mjs.Fresh exact-head evidence
Current exact head:
ebde3720ee27292be0ce3315986e0438dd66af9f.cirun31367707468: terminal success;reviewer-cirun31367707469: terminal success;Security Scanrun31367707433: terminal success under its own scanner/revision semantics;The fresh technical evidence is sufficient to leave Draft. It is not merge authority: live enforceable governance under #27 and qualifying independent formal review remain separate fail-closed gates.
Supersession
#89 was closed only after this clean protected-main successor received fresh terminal-success application/reviewer/security evidence proving the restack is technically intact. Old #89 evidence does not transfer.
Merge boundary
Do not merge unless the unchanged exact head still satisfies every actual current CI/security/coverage/package/provenance gate, current review/thread evidence remains clean, live ruleset/governance requirements are proven, and qualifying independent non-author formal approval is satisfied where required. No repair/self-modifying workflow, protection weakening, synthetic approval, version bump, release or deployment authority is introduced.
Related: #27, #29, #77, #79, #80, #90
Summary by CodeRabbit
개선 사항
nanoid보안 수정 버전을 적용했습니다.문서
검증