fix(release): make packed-consumer verify self-contained for unpublished versions#2396
Merged
Merged
Conversation
verifyPackedConsumer installs each package as a file: tarball, but each tarball pins its inter-@hyperframes deps to the exact release version. On a release bump that version is not on the npm registry yet, so bun resolves the transitive deps from the registry and fails. Add an overrides map forcing every @hyperframes/* to the sibling local tarball, making the check self-contained pre-publish. Exercised by the v0.7.57 release PR.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
verify:packed-manifests's consumer fixture (added in #2149) installs each package as afile:tarball, but each tarball pins its inter-@hyperframesdeps to the exact release version. On a release bump the new version isn't on the npm registry yet, sobun installresolves those transitive deps from the registry and fails withNo version matching <v>.Why
This passed until now only because the check had only ever run at an already-published version (e.g. a normal PR at
0.7.56). The first real release to run it (v0.7.57) fails, and sincepublish.ymlruns the same step before publishing with nocontinue-on-error, it would block the actual publish too. Affects every future release.How
Add an
overridesmap to the consumer fixture pinning every@hyperframes/*to its sibling local tarball, so transitive deps resolve locally instead of from the registry. Makes the check self-contained pre-publish; behavior at published versions is unchanged.Test plan
bun run verify:packed-manifestspasses ("Resolved 90 packed exports and loaded public SDK adapters. Verified clean packed consumer install, type resolution, and CLI startup.").Not covered: pinning bun's version in CI (separate concern).