chore: workspace dependency hygiene + CI/release pipeline - #1
Merged
Conversation
The express/fastify version aliases (express/express4, fastify/fastify4) and @types/express were declared in each publishable package's devDependencies. They are test-only tooling: the package tests require both framework majors to assert parity across them. Declaring them once at the workspace root keeps the published packages free of dev-only framework aliases and lets the tests resolve them through hoisting. test-servers keeps its own express4/5 + fastify4/5 because it is a private workspace that imports them at runtime.
express and fastify pinned @exortek/nosql-sanitize-core at a hardcoded ^3.0.0, so every core version bump had to be mirrored by hand. Switching to workspace:^ lets yarn substitute the current core version as a caret range at publish time (verified: the packed manifest resolves to ^3.0.0), so the range tracks the core version automatically. This requires publishing through yarn (npm publish leaves the literal workspace:^ string in the tarball), so the publish scripts move from raw npm publish to yarn workspace ... npm publish, and publish:all now publishes topologically (core before express/fastify) via foreach.
Tracks the current major of fastify-plugin. The plugin wrapper API used by the sanitizer (fp(plugin, meta)) is unchanged across the major, and the Fastify 4/5 integration suites pass on it.
format:check is the read-only prettier gate CI runs (the existing format script writes). verify chains format:check + test + test:servers into a single local mirror of the CI pipeline, so contributors can reproduce the gate before pushing.
Runs on push to master, every PR, and manual dispatch. Installs with --immutable and runs yarn verify (format:check + unit tests + the Express 4/5 and Fastify 4/5 integration servers). Concurrency-guarded so a new push cancels the in-flight run for the same ref.
Scans the shipped library source only (packages/*/src, scoped in codeql-config.yml) so tests, examples, benchmarks, and the test servers are never reported on. Runs on push/PR to master, a weekly schedule, and manual dispatch; docs-only changes skip the run.
Manual (workflow_dispatch) publish with a dry_run toggle. Gates on the full test suite, then publishes the public packages topologically (core before express/fastify) via yarn npm publish, which substitutes the workspace:^ range. Uses OIDC Trusted Publishing + provenance rather than a stored NPM_TOKEN; each package needs a trusted publisher configured on npmjs.com first.
SECURITY.md documents supported versions, private advisory reporting, disclosure timeline, and the sanitizer's hardening invariants (operator stripping, prototype-pollution defence, no regex lastIndex leakage, bounded recursion). CONTRIBUTING.md covers setup, the root-hoisted framework versions, commit conventions, and the yarn verify gate.
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What & why
Repo hygiene pass that reorganizes dependency declarations, adds a CI/release pipeline, and documents security + contribution conventions. No library source (
packages/*/src) changes — behaviour is unchanged; all unit (176) and integration (87) tests pass.Changes
Dependencies
express/express4andfastify/fastify4aliases (+@types/express) were declared in each publishable package'sdevDependencies. They are test-only tooling, so they now live once in the rootpackage.json; the package tests resolve them through workspace hoisting.test-serverskeeps its own copies (private workspace, runtime imports).workspace:^.express/fastifypinned@exortek/nosql-sanitize-coreat a hardcoded^3.0.0;workspace:^lets yarn substitute the current core version as a caret range at publish time (verified: packed manifest resolves to^3.0.0). This requires publishing through yarn, so thepublish:*scripts move toyarn ... npm publishandpublish:allpublishes topologically.fastify-pluginto v6.Tooling & CI
format:check(read-only prettier gate) +verify(format:check + test + test:servers) scripts..github/workflows/ci.yml— runsyarn verifyon push/PR/dispatch,--immutableinstall, concurrency-guarded..github/workflows/codeql.yml(+ config) — scanspackages/*/srconly..github/workflows/release.yml— manual, gated on tests, topological publish via OIDC Trusted Publishing + provenance.Docs
SECURITY.md— supported versions, private advisory flow, disclosure timeline, sanitizer hardening invariants.CONTRIBUTING.md— setup, root-hoisted framework versions, commit conventions, theyarn verifygate.Follow-up / setup needed
yarn.lock— it was committed empty (0 bytes), which would breakyarn install --immutablein CI. Now populated.@exortek/*packages (repoExorTek/nosql-sanitize, workflowrelease.yml), or switch the workflow to anNPM_TOKENsecret.