-
Notifications
You must be signed in to change notification settings - Fork 14
Chore/update ng 20 #590
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: master
Are you sure you want to change the base?
Chore/update ng 20 #590
Changes from all commits
ebefaee
0aaa257
b67ba84
71125d1
327143a
d787439
037f1a6
6f0b19b
4c4068c
b85fbf1
39ab60e
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,2 +1,2 @@ | ||
| @import './reset-browser'; | ||
| @import '../src/theme/style.scss'; | ||
| @use './reset-browser' as *; | ||
| @use '../src/theme/style.scss' as *; |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,11 @@ | ||
| module.exports = { | ||
| name: 'plugin-prepare-lifecycle', | ||
| factory: (e) => ({ | ||
| hooks: { | ||
| afterAllInstalled(r) { | ||
| if (!r.topLevelWorkspace.manifest.scripts.get('prepare')) return; | ||
| e('@yarnpkg/shell').execute('yarn prepare'); | ||
| }, | ||
| }, | ||
| }), | ||
| }; |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,7 @@ | ||
| nodeLinker: node-modules | ||
|
|
||
| npmRegistryServer: "https://registry.npmmirror.com" | ||
|
|
||
| plugins: | ||
| - path: .yarn/plugins/plugin-prepare-lifecycle.cjs | ||
| spec: "https://github.com/un-es/yarn-plugin-prepare-lifecycle/releases/download/v0.0.1/index.js" | ||
|
Comment on lines
+5
to
+7
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 💡 Verification agent 🧩 Analysis chainThird‑party Yarn plugin: pin, vendor, and assess install-time script risk Loading a remote plugin that re-enables prepare executes arbitrary scripts during install. Ensure the plugin file is committed, the version is pinned, and scripts are disabled in CI if not required there. Actions:
Quick checks: If you want this only for local dev, consider moving plugin loading behind a separate local rc (e.g., .yarnrc.local.yml) not committed to CI. I can draft that change. 🏁 Script executed: #!/bin/bash
# 1) File must exist in repo
test -f .yarn/plugins/plugin-prepare-lifecycle.cjs && echo "Plugin file present" || { echo "Missing plugin file"; exit 1; }
# 2) Confirm spec is pinned to an exact tag
yq '.plugins[] | select(.path==".yarn/plugins/plugin-prepare-lifecycle.cjs") | .spec' .yarnrc.yml
# 3) Optional: record checksum for audit logs
shasum -a 256 .yarn/plugins/plugin-prepare-lifecycle.cjsLength of output: 450 🏁 Script executed: #!/bin/bash
# 1) Verify plugin file present
if test -f .yarn/plugins/plugin-prepare-lifecycle.cjs; then
echo "Plugin file present"
else
echo "Missing plugin file"
exit 1
fi
# 2) Confirm spec pinned in .yarnrc.yml
grep -nP '^\s*spec:\s*".*"' .yarnrc.yml | grep 'plugin-prepare-lifecycle.cjs' \
&& echo "Spec is pinned" \
|| { echo "Spec not pinned or missing"; exit 1; }
# 3) Compute SHA-256 checksum of the plugin file
if command -v sha256sum >/dev/null; then
sha256sum .yarn/plugins/plugin-prepare-lifecycle.cjs
elif command -v openssl >/dev/null; then
openssl dgst -sha256 .yarn/plugins/plugin-prepare-lifecycle.cjs
else
echo "No checksum tool available"
exit 1
fiLength of output: 251 🏁 Script executed: #!/bin/bash
# 1) Display the plugin block with spec for manual verification
sed -n -e '/- path: \.yarn\/plugins\/plugin-prepare-lifecycle\.cjs/,+2p' .yarnrc.yml
# 2) Compute SHA-256 checksum of the vendored plugin file
if command -v sha256sum >/dev/null; then
sha256sum .yarn/plugins/plugin-prepare-lifecycle.cjs
elif command -v openssl >/dev/null; then
openssl dgst -sha256 .yarn/plugins/plugin-prepare-lifecycle.cjs
else
echo "Error: no checksum tool available" >&2
exit 1
fiLength of output: 370 Record checksum and disable install-time scripts in CI
🤖 Prompt for AI Agents |
||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Import
addonsfrom preview API, not manager API (SB9).In preview files, use
storybook/preview-api;storybook/manager-apiis for the manager UI. This prevents API/context mismatches.Apply:
Supporting refs: addon API and SB9 package consolidation.
📝 Committable suggestion
🤖 Prompt for AI Agents