chore: replace yarn with npm #629

boneskull · 2023-07-24T19:54:35Z

This removes yarn in lieu of npm.

I'm unsure if this affects @lavamoat/yarn-plugin-allow-scripts or not.

Two further PRs will build on this. It is part of the "new release process" effort.

boneskull · 2023-07-24T19:54:47Z

Current dependencies on/for this PR:

main
- PR chore: replace yarn with npm #629 👈
  - PR fix(lavamoat): allow prefixed builtins #653
  - PR chore: normalize test config #643
    - PR feat(core): add a schema for policy files #620
  - PR chore: add commit hooks #632
  - PR chore: reconfigure lerna for releases #631
  - PR chore(ci): add a release-please configuration #630
  - PR chore: consolidate eslint config #627
    - PR chore(deps): remove @metamask/eslint-config-nodejs #639
    - PR feat(allow-scripts): generate & ship typescript declarations #617

This comment was auto-generated by Graphite.

packages/browserify/test/fixtures/secureBundling/lavamoat/node/policy.json

naugtur · 2023-07-28T09:13:59Z

packages/node/test/projects/2/package.json

  },
  "dependencies": {
-    "keccak": "^3.0.0"
+    "keccak": "3.0.0"


makes sense 👍

naugtur · 2023-07-28T09:16:52Z

packages/perf/package.json

@@ -29,9 +30,6 @@
  "devDependencies": {
    "serve": "^14.2.0"
  },
-  "resolutions": {
-    "serve/boxen/type-fest": "^2.13.0"
-  },


@kumavis Do you have any memory of the reason behind type-fest being resolved to 2.13 in perf and to 0.21 pretty much everywhere else?

unless something is using tsc to build or check types when running things in perf, I'm unsure how this could be a problem. type-fest contains no code and does nothing

naugtur · 2023-07-28T09:18:56Z

@lavamoat/yarn-plugin-allow-scripts is a helper for getting allow-scripts to run under yarn3. It should not be affected by this.

boneskull · 2023-07-28T17:43:20Z

@lavamoat/yarn-plugin-allow-scripts is a helper for getting allow-scripts to run under yarn3. It should not be affected by this.

@naugtur Why is it a private package? How is it consumed?

naugtur · 2023-07-28T18:17:42Z

Yarn copies it over from a GitHub url because the plugin is supposed to be installed before any packages can get installed 🙈

boneskull · 2023-07-31T18:13:45Z

Yarn copies it over from a GitHub url because the plugin is supposed to be installed before any packages can get installed 🙈

how does this even make sense

naugtur · 2023-08-01T07:13:59Z

Yarn copies it over from a GitHub url because the plugin is supposed to be installed before any packages can get installed 🙈

how does this even make sense

I guess that's why npm doesn't have plugins. But it does make sense in the context of what the plugins are for - it means they need to be installed before any package management happens, so they must be a single-file fetchable from URL/

naugtur

Now that these are merged I see what I missed before - reviewing each changeset separately I assumed one of the other ones would contain an update to the RELEASE.md file with the updated process description step-by-step so that everyone knows how to proceed with releasing.

boneskull · 2023-08-03T07:37:09Z

@naugtur RELEASE.md is ready for you

naugtur

Thumbsup on the release description. Approving the pr.

(could) I'd prefer to keep the dependency picture (mermaid graph) somewhere and this file seems like a good place for it.

(later) A checklist for the person doing the release (what to look for in the PR etc) should go into this file too.

Used [synp](https://npm.im/synp) to convert from `yarn.lock` to `package-lock.json`. All resulting `package-lock.json` files are v1 _except_ the root which is v2.

This removes all yarn config, caches, and lockfiles, and changes all scripts to use `npm run` instead of yarn`. It means `lerna bootstrap` is no longer needed, and `lerna` is not needed (but can still be used) to run scripts across workspaces. There should only be _one_ lockfile: the root `package-lock.json`. Note that this change impacts what would be done in #625. Test fixtures, when installed, should no longer create lockfiles. A note on "resolutions": these become `overrides` and everything can be done in the monorepo root. This changeset does not modify CI.

- fix `test:prep` execution - using `npm`, node/test/projects/1/node_modules will be symlinked and not under vcs - pin keccak version - cleanup `allow-scripts` tests (a bit of DRY, fix misuse of `path.join`, make fs cleanup more consistent) - fix a problem in the `allow-scripts` tests where _not enough_ cleanup was happening

This is an experimental change. It modifies the Lerna configuration to publish independent packages (without `nx`) using conventional commits. This will create/update CHANGELOGs and create GitHub Releases for each workspace upon publish. This is what [Appium](https://github.com/appium/appium) does, and I believe the goals for our release process are nearly identical. Please look at the releases/tags in that repo for what you get. To publish, run `npm run publish`.

This encodes the proper `lerna publish` flags within `lerna.json`. `release-please` will handle creating the GitHub release and updating the changelog, and we just want Lerna to publish what we have. These flags are essentially the same thing we have currently, sans the `--yes` flag.

- adds a pre-commit hook that runs `eslint --fix` on any JS file on the stage - adds a commit message check that verifies the commit message is in conventional commits format - adds `husky install` to workspace root `postinstall` script, to be run via `allow-scripts` - adds a `prepare` lifecycle script which runs the `rebuild` script - remove `preversion` script

This disables the `separate-pull-requests` flag, as enabling it adds too much opportunity for human error to befoul the process. It also enables the `node-workspace` plugin: > The node-workspace plugin builds a graph of local node packages configured in release-please-config.json and the dependency relationships between them. It looks at what packages were updated by release-please and updates their reference in other packages' dependencies lists. Even when a particular package was not updated by release-please, if a dependency did have an update, it will be patch bump the package, create a changelog entry, and add it to the list of PR changes. Under the hood, this plugin adapts specific dependency graph building and updating functionality from the popular lerna tool. Finally, the `prepare` script is removed and a `prepublishOnly` script then rebuilds any artifacts and runs a full test suite before the final publish is green-lit.

Use cross-env for cross-platform compat. This does not mean other scripts work across platforms, but we should move in that direction.

boneskull · 2023-08-16T22:22:45Z

I've restored the table in RELEASE.md.

boneskull force-pushed the boneskull/npm branch from db7a3ff to bc16a88 Compare July 25, 2023 20:34

boneskull self-assigned this Jul 25, 2023

boneskull mentioned this pull request Jul 25, 2023

chore: add commit hooks #632

Merged

boneskull added the chore overhead, tests, dev env, etc. label Jul 25, 2023

boneskull force-pushed the boneskull/npm branch from bc16a88 to 42c355b Compare July 25, 2023 23:26

This was referenced Jul 25, 2023

chore: reconfigure lerna for releases #631

Merged

chore(ci): add a release-please configuration #630

Merged

boneskull force-pushed the boneskull/npm branch from 42c355b to 28a17c4 Compare July 26, 2023 22:00

boneskull mentioned this pull request Jul 27, 2023

chore: consolidate eslint config #627

Merged

boneskull changed the title ~~[DRAFT] chore: replace yarn with npm~~ chore: replace yarn with npm Jul 27, 2023

boneskull marked this pull request as ready for review July 27, 2023 07:56

boneskull requested review from naugtur, kumavis, leotm, weizman and legobeat July 27, 2023 20:18

boneskull mentioned this pull request Jul 27, 2023

feat(allow-scripts): generate & ship typescript declarations #617

Closed

boneskull force-pushed the boneskull/npm branch from 28a17c4 to 99932aa Compare July 27, 2023 21:45

naugtur reviewed Jul 28, 2023

View reviewed changes

packages/browserify/test/fixtures/secureBundling/lavamoat/node/policy.json Show resolved Hide resolved

naugtur reviewed Jul 28, 2023

View reviewed changes

boneskull force-pushed the boneskull/npm branch from 99932aa to 9c47351 Compare July 28, 2023 17:39

boneskull mentioned this pull request Jul 28, 2023

remove dependency on @metamask/eslint-config-nodejs #637

Closed

naugtur approved these changes Jul 31, 2023

View reviewed changes

boneskull mentioned this pull request Jul 31, 2023

chore(deps): remove @metamask/eslint-config-nodejs #639

Merged

naugtur requested changes Aug 1, 2023

View reviewed changes

boneskull force-pushed the boneskull/npm branch from 71cafd5 to 598b40d Compare August 2, 2023 19:37

boneskull requested a review from naugtur August 2, 2023 19:40

boneskull mentioned this pull request Aug 8, 2023

chore: normalize test config #643

Merged

boneskull force-pushed the boneskull/npm branch from 9b9495d to 62065a6 Compare August 10, 2023 21:57

This was referenced Aug 10, 2023

feat(core): add a schema for policy files #620

Closed

chore(node): run tests against multiple package managers #648

Merged

fix(lavamoat): allow prefixed builtins #653

Merged

naugtur approved these changes Aug 16, 2023

View reviewed changes

boneskull added 15 commits August 16, 2023 15:18

chore: convert lockfiles

aeb1e2c

Used [synp](https://npm.im/synp) to convert from `yarn.lock` to `package-lock.json`. All resulting `package-lock.json` files are v1 _except_ the root which is v2.

chore: upgrade all package-lock.json files

7df0fd7

chore(ci): update CI to use npm

5223de2

chore: fix lint config

2b5ea8a

chore(ci): add commitlint workflow

ff71064

docs(release): update release documentation

a14af5e

chore(perf): add dummy test script

e05e925

chore: enable NODE_ENV=production for prepublishOnly

fa37992

Use cross-env for cross-platform compat. This does not mean other scripts work across platforms, but we should move in that direction.

chore(yarn-plugin-allow-scripts): add stub test script

f69b08b

boneskull force-pushed the boneskull/npm branch from 6d08610 to f69b08b Compare August 16, 2023 22:18

boneskull merged commit db62b17 into main Aug 16, 2023
9 checks passed

boneskull deleted the boneskull/npm branch January 19, 2024 21:37

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore: replace yarn with npm #629

chore: replace yarn with npm #629

boneskull commented Jul 24, 2023

boneskull commented Jul 24, 2023 •

edited

naugtur Jul 28, 2023

naugtur Jul 28, 2023

boneskull Jul 28, 2023

naugtur commented Jul 28, 2023

boneskull commented Jul 28, 2023 •

edited

naugtur commented Jul 28, 2023

boneskull commented Jul 31, 2023

naugtur commented Aug 1, 2023

naugtur left a comment

boneskull commented Aug 3, 2023

naugtur left a comment •

edited

boneskull commented Aug 16, 2023

chore: replace yarn with npm #629

chore: replace yarn with npm #629

Conversation

boneskull commented Jul 24, 2023

boneskull commented Jul 24, 2023 • edited

naugtur Jul 28, 2023

Choose a reason for hiding this comment

naugtur Jul 28, 2023

Choose a reason for hiding this comment

boneskull Jul 28, 2023

Choose a reason for hiding this comment

naugtur commented Jul 28, 2023

boneskull commented Jul 28, 2023 • edited

naugtur commented Jul 28, 2023

boneskull commented Jul 31, 2023

naugtur commented Aug 1, 2023

naugtur left a comment

Choose a reason for hiding this comment

boneskull commented Aug 3, 2023

naugtur left a comment • edited

Choose a reason for hiding this comment

boneskull commented Aug 16, 2023

boneskull commented Jul 24, 2023 •

edited

boneskull commented Jul 28, 2023 •

edited

naugtur left a comment •

edited