Skip to content

Commit 2608ddb

Browse files
rochdevrochdev
authored
chore: vendor on npm prepare instead of committing to git (#7423)
* remove vendor dist folder * switch to npm for vendoring * update license attribution script
1 parent 2e732ef commit 2608ddb

File tree

131 files changed

+898
-3005
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

131 files changed

+898
-3005
lines changed

‎.github/workflows/dependabot-automation.yml‎

Lines changed: 2 additions & 300 deletions
Original file line numberDiff line numberDiff line change
@@ -12,28 +12,10 @@ env:
1212
GROUPS: '["dev-minor-and-patch-dependencies", "gh-actions-packages", "test-versions"]'
1313

1414
jobs:
15-
dependabot:
16-
if: github.event.pull_request.user.login == 'dependabot[bot]'
17-
runs-on: ubuntu-latest
18-
# Keep this job as a stable, always-green check on Dependabot PRs, even when the workflow is
19-
# re-triggered by an automation commit (e.g., vendoring). Sensitive operations (OIDC token mint,
20-
# approving, enabling auto-merge) are delegated to `dependabot-automation` below.
21-
permissions:
22-
contents: read
23-
steps:
24-
- name: Status
25-
run: |
26-
echo "Dependabot PR detected."
27-
if [ "${{ github.actor }}" = "dependabot[bot]" ]; then
28-
echo "Automation steps will run in the 'dependabot-automation' job."
29-
else
30-
echo "Skipping automation: workflow actor is '${{ github.actor }}'."
31-
fi
32-
3315
dependabot-automation:
3416
# Only run automation on the initial Dependabot-triggered run. If an automation commit is pushed
35-
# (e.g. vendor output), GitHub re-triggers this workflow with `github.actor == 'dd-octo-sts[bot]'`.
36-
# We intentionally avoid minting tokens / approving / enabling auto-merge on that follow-up run.
17+
# GitHub re-triggers this workflow with `github.actor == 'dd-octo-sts[bot]'`. We intentionally
18+
# avoid minting tokens / approving / enabling auto-merge on that follow-up run.
3719
if: github.event.pull_request.user.login == 'dependabot[bot]' && github.actor == 'dependabot[bot]'
3820
runs-on: ubuntu-latest
3921
permissions:
@@ -61,283 +43,3 @@ jobs:
6143
env:
6244
PR_URL: ${{ github.event.pull_request.html_url }}
6345
GH_TOKEN: ${{ steps.octo-sts.outputs.token }}
64-
65-
vendor-build:
66-
if: github.event.pull_request.user.login == 'dependabot[bot]'
67-
runs-on: ubuntu-latest
68-
# Security: this job checks out and runs code from the PR (vendoring build),
69-
# so it is intentionally restricted to read-only permissions and produces a
70-
# patch artifact instead of pushing directly.
71-
permissions:
72-
contents: read
73-
pull-requests: read
74-
outputs:
75-
has_changes: ${{ steps.diff.outputs.has_changes }}
76-
is_vendor_group: ${{ steps.ctx.outputs.is_vendor_group }}
77-
steps:
78-
- name: Dependabot metadata
79-
id: metadata
80-
uses: dependabot/fetch-metadata@21025c705c08248db411dc16f3619e6b5f9ea21a # 2.5.0
81-
- name: Compute vendor context
82-
id: ctx
83-
run: |
84-
set -euo pipefail
85-
86-
echo "is_vendor_group=${{ steps.metadata.outputs.directory == '/vendor' }}" >> $GITHUB_OUTPUT
87-
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
88-
if: steps.ctx.outputs.is_vendor_group == 'true'
89-
with:
90-
repository: ${{ github.event.pull_request.head.repo.full_name }}
91-
ref: ${{ github.event.pull_request.head.sha }}
92-
fetch-depth: 1
93-
persist-credentials: false
94-
- name: Restore trusted Node setup actions
95-
if: steps.ctx.outputs.is_vendor_group == 'true'
96-
run: |
97-
git fetch --no-tags --depth=1 origin "${{ github.event.pull_request.base.sha }}"
98-
git checkout "${{ github.event.pull_request.base.sha }}" -- .github/actions/node
99-
- name: Restore trusted vendoring scripts
100-
if: steps.ctx.outputs.is_vendor_group == 'true'
101-
run: |
102-
git fetch --no-tags --depth=1 origin "${{ github.event.pull_request.base.sha }}"
103-
git checkout "${{ github.event.pull_request.base.sha }}" -- vendor/rspack.js vendor/rspack.config.js
104-
- uses: ./.github/actions/node/active-lts
105-
if: steps.ctx.outputs.is_vendor_group == 'true'
106-
- name: Install vendoring deps (no lifecycle scripts)
107-
if: steps.ctx.outputs.is_vendor_group == 'true'
108-
run: yarn --ignore-scripts --frozen-lockfile --non-interactive
109-
working-directory: ./vendor
110-
- name: Build vendored bundles (trusted script)
111-
if: steps.ctx.outputs.is_vendor_group == 'true'
112-
run: node ./rspack.js
113-
working-directory: ./vendor
114-
- name: Create patch (restricted paths only)
115-
id: diff
116-
run: |
117-
set -euo pipefail
118-
119-
if [ "${{ steps.ctx.outputs.is_vendor_group }}" != "true" ]; then
120-
echo "has_changes=false" >> $GITHUB_OUTPUT
121-
exit 0
122-
fi
123-
124-
if git diff --quiet; then
125-
echo "has_changes=false" >> $GITHUB_OUTPUT
126-
exit 0
127-
fi
128-
129-
allowed_prefix_1="vendor/dist/"
130-
allowed_file_1="vendor/package.json"
131-
allowed_file_2="vendor/yarn.lock"
132-
133-
bad=0
134-
while IFS= read -r file; do
135-
case "$file" in
136-
"$allowed_file_1" | "$allowed_file_2" | "$allowed_prefix_1"*)
137-
;;
138-
*)
139-
echo "Unexpected changed path: $file"
140-
bad=1
141-
;;
142-
esac
143-
done < <(git diff --name-only)
144-
145-
if [ "$bad" -ne 0 ]; then
146-
echo "Refusing to proceed: unexpected paths changed during vendoring."
147-
exit 1
148-
fi
149-
150-
git diff --binary --no-color > "${RUNNER_TEMP}/vendor.patch"
151-
echo "has_changes=true" >> $GITHUB_OUTPUT
152-
- uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
153-
if: steps.diff.outputs.has_changes == 'true'
154-
with:
155-
name: vendor-patch
156-
path: ${{ runner.temp }}/vendor.patch
157-
if-no-files-found: error
158-
159-
vendor-push:
160-
if: github.event.pull_request.user.login == 'dependabot[bot]' && needs.vendor-build.outputs.is_vendor_group == 'true' && needs.vendor-build.outputs.has_changes == 'true'
161-
runs-on: ubuntu-latest
162-
needs: vendor-build
163-
# Security: this job never runs installs/builds.
164-
# It only applies the vetted patch artifact and writes the update via the GitHub API.
165-
permissions:
166-
id-token: write
167-
steps:
168-
- uses: DataDog/dd-octo-sts-action@acaa02eee7e3bb0839e4272dacb37b8f3b58ba80 # v1.0.3
169-
id: octo-sts
170-
with:
171-
scope: DataDog/dd-trace-js
172-
policy: dependabot-automation
173-
- name: Dependabot metadata
174-
id: metadata
175-
uses: dependabot/fetch-metadata@21025c705c08248db411dc16f3619e6b5f9ea21a # 2.5.0
176-
with:
177-
github-token: "${{ steps.octo-sts.outputs.token }}"
178-
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
179-
with:
180-
token: ${{ steps.octo-sts.outputs.token }}
181-
repository: ${{ github.event.pull_request.head.repo.full_name }}
182-
ref: ${{ github.event.pull_request.head.sha }}
183-
persist-credentials: false
184-
- uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
185-
with:
186-
name: vendor-patch
187-
path: ${{ runner.temp }}/vendor-artifact
188-
- name: Apply patch
189-
run: git apply --whitespace=nowarn "${{ runner.temp }}/vendor-artifact/vendor.patch"
190-
- name: Validate changed paths
191-
run: |
192-
set -euo pipefail
193-
194-
allowed_prefix_1="vendor/dist/"
195-
allowed_file_1="vendor/package.json"
196-
allowed_file_2="vendor/yarn.lock"
197-
198-
bad=0
199-
while IFS= read -r file; do
200-
case "$file" in
201-
"$allowed_file_1" | "$allowed_file_2" | "$allowed_prefix_1"*)
202-
;;
203-
*)
204-
echo "Unexpected changed path after applying patch: $file"
205-
bad=1
206-
;;
207-
esac
208-
done < <(git diff --name-only)
209-
210-
if [ "$bad" -ne 0 ]; then
211-
echo "Refusing to proceed: unexpected paths changed."
212-
exit 1
213-
fi
214-
- name: Create verified commit via GitHub API (server-side)
215-
env:
216-
TARGET_BRANCH: ${{ github.event.pull_request.head.ref }}
217-
GH_TOKEN: ${{ steps.octo-sts.outputs.token }}
218-
run: |
219-
set -euo pipefail
220-
221-
repo="${GITHUB_REPOSITORY}"
222-
expected_head_oid="$(git rev-parse HEAD)"
223-
224-
max_files=200
225-
max_total_bytes=$((10 * 1024 * 1024)) # 10 MiB
226-
227-
mapfile -t changes < <(git diff --name-status)
228-
change_count="${#changes[@]}"
229-
if [ "$change_count" -eq 0 ]; then
230-
echo "No changed files detected."
231-
exit 1
232-
fi
233-
if [ "$change_count" -gt "$max_files" ]; then
234-
echo "Too many changed files ($change_count > $max_files)."
235-
exit 1
236-
fi
237-
238-
additions='[]'
239-
deletions='[]'
240-
total_bytes=0
241-
for change in "${changes[@]}"; do
242-
read -r status path path2 <<<"$change"
243-
244-
if [[ "$status" == D ]]; then
245-
deletions="$(jq -c --arg path "$path" '. + [{path: $path}]' <<<"$deletions")"
246-
continue
247-
fi
248-
249-
# Treat renames as delete+add to keep the server-side tree in sync.
250-
if [[ "$status" == R* ]]; then
251-
deletions="$(jq -c --arg path "$path" '. + [{path: $path}]' <<<"$deletions")"
252-
path="$path2"
253-
fi
254-
255-
test -f "$path"
256-
file_bytes="$(stat -c '%s' "$path")"
257-
total_bytes=$((total_bytes + file_bytes))
258-
if [ "$total_bytes" -gt "$max_total_bytes" ]; then
259-
echo "Total changes too large (${total_bytes} bytes)."
260-
exit 1
261-
fi
262-
contents="$(base64 -w 0 "$path")"
263-
additions="$(jq -c --arg path "$path" --arg contents "$contents" '. + [{path: $path, contents: $contents}]' <<<"$additions")"
264-
done
265-
266-
variables="$(jq -c \
267-
--arg repo "$repo" \
268-
--arg branch "$TARGET_BRANCH" \
269-
--arg msg "update vendored dependencies with new versions" \
270-
--arg expected "$expected_head_oid" \
271-
--argjson additions "$additions" \
272-
--argjson deletions "$deletions" \
273-
'{
274-
input: {
275-
branch: { repositoryNameWithOwner: $repo, branchName: $branch },
276-
message: { headline: $msg },
277-
expectedHeadOid: $expected,
278-
fileChanges: { additions: $additions, deletions: $deletions }
279-
}
280-
}'
281-
)"
282-
283-
query='mutation($input: CreateCommitOnBranchInput!) { createCommitOnBranch(input: $input) { commit { oid url } } }'
284-
gh api graphql -f query="$query" -f variables="$variables" -q '.data.createCommitOnBranch.commit.oid' >/dev/null
285-
286-
# If branch protection is configured to dismiss stale approvals when new commits are pushed,
287-
# the vendoring commit will invalidate the earlier approval. Re-approve and (re-)enable
288-
# auto-merge after pushing so Dependabot PRs can still merge automatically.
289-
- name: Approve a PR (after vendoring commit)
290-
if: contains(fromJSON(env.GROUPS), steps.metadata.outputs.dependency-group)
291-
run: gh pr review --approve "$PR_URL"
292-
env:
293-
PR_URL: ${{ github.event.pull_request.html_url }}
294-
GH_TOKEN: ${{ steps.octo-sts.outputs.token }}
295-
- name: Enable auto-merge for Dependabot PRs (after vendoring commit)
296-
if: contains(fromJSON(env.GROUPS), steps.metadata.outputs.dependency-group)
297-
run: gh pr merge --auto --squash "$PR_URL"
298-
env:
299-
PR_URL: ${{ github.event.pull_request.html_url }}
300-
GH_TOKEN: ${{ steps.octo-sts.outputs.token }}
301-
302-
vendor-validate:
303-
# Run validation after the generated vendor patch has been pushed, to ensure the PR contains
304-
# the committed `vendor/dist/*` outputs. This runs inside the same workflow as the push, so it
305-
# doesn't rely on additional workflows being triggered by that push.
306-
if: github.event.pull_request.user.login == 'dependabot[bot]' && needs.vendor-build.outputs.is_vendor_group == 'true' && needs.vendor-build.outputs.has_changes == 'true'
307-
runs-on: ubuntu-latest
308-
needs:
309-
- vendor-build
310-
- vendor-push
311-
permissions:
312-
contents: read
313-
pull-requests: read
314-
steps:
315-
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
316-
with:
317-
repository: ${{ github.event.pull_request.head.repo.full_name }}
318-
ref: ${{ github.event.pull_request.head.ref }}
319-
fetch-depth: 1
320-
persist-credentials: false
321-
- name: Restore trusted Node setup actions
322-
run: |
323-
git fetch --no-tags --depth=1 origin "${{ github.event.pull_request.base.sha }}"
324-
git checkout "${{ github.event.pull_request.base.sha }}" -- .github/actions/node
325-
- name: Restore trusted vendoring scripts
326-
run: |
327-
git fetch --no-tags --depth=1 origin "${{ github.event.pull_request.base.sha }}"
328-
git checkout "${{ github.event.pull_request.base.sha }}" -- vendor/rspack.js vendor/rspack.config.js
329-
- uses: ./.github/actions/node/active-lts
330-
# Running `yarn` also automatically runs Rspack as a postinstall script.
331-
- run: yarn --frozen-lockfile
332-
working-directory: vendor
333-
- name: Ensure no untracked outputs
334-
run: |
335-
set -euo pipefail
336-
337-
if [ -n "$(git status --porcelain)" ]; then
338-
echo "Working tree is dirty after vendoring:"
339-
git status --porcelain
340-
exit 1
341-
fi
342-
- name: Diff only expected paths
343-
run: git diff --exit-code -- vendor/dist vendor/package.json vendor/yarn.lock

‎.github/workflows/platform.yml‎

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -43,7 +43,8 @@ jobs:
4343
steps:
4444
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
4545
- uses: ./.github/actions/node/active-lts
46-
- run: FILENAME=$(npm pack --pack-destination /tmp) && mv /tmp/$FILENAME /tmp/dd-trace.tgz
46+
- uses: ./.github/actions/install
47+
- run: FILENAME=$(npm pack --silent --pack-destination /tmp) && mv /tmp/$FILENAME /tmp/dd-trace.tgz
4748
- run: mkdir -p /tmp/app
4849
- run: npm i -g pnpm
4950
if: matrix.manager.name == 'pnpm'
@@ -58,7 +59,7 @@ jobs:
5859
- uses: ./.github/actions/node/active-lts
5960
- uses: ./.github/actions/install
6061
- run: mkdir npm bun
61-
- run: FILENAME=$(npm pack) && tar -zxf $FILENAME -C npm
62+
- run: FILENAME=$(npm pack --silent) && tar -zxf $FILENAME -C npm
6263
- run: ./node_modules/.bin/bun pm pack --gzip-level 0 --filename bun.tgz && tar -zxf bun.tgz -C bun
6364
- run: diff -r npm bun
6465

@@ -446,12 +447,13 @@ jobs:
446447
runs-on: ubuntu-latest
447448
steps:
448449
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
449-
- uses: ./.github/actions/node
450-
with:
451-
version: ${{ matrix.version }}
450+
- uses: ./.github/actions/node/active-lts
452451
- uses: ./.github/actions/install
453452
- run: bun add --ignore-scripts mocha@10 # Use older mocha to support old Node.js versions
454453
- run: bun add --ignore-scripts express@4 # Use older express to support old Node.js versions
454+
- uses: ./.github/actions/node
455+
with:
456+
version: ${{ matrix.version }}
455457
- run: node node_modules/.bin/mocha --colors --timeout 30000 integration-tests/init.spec.js
456458
- uses: DataDog/junit-upload-github-action@055560f63c405095e9228ba443eee7987e22bb94 # v2.1.1
457459
if: always() && github.actor != 'dependabot[bot]'

‎.github/workflows/project.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -76,7 +76,7 @@ jobs:
7676
steps:
7777
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
7878
- uses: ./.github/actions/node/latest
79-
- run: FILENAME=$(npm pack --pack-destination /tmp) && mv /tmp/$FILENAME /tmp/dd-trace.tgz
79+
- run: FILENAME=$(npm pack --silent --pack-destination /tmp) && mv /tmp/$FILENAME /tmp/dd-trace.tgz
8080
- run: rm -rf *
8181
- run: tar -zxf /tmp/dd-trace.tgz -C $(pwd) --strip-components=1
8282
- run: yarn --prod --ignore-optional

‎.github/workflows/system-tests.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@ jobs:
2424
with:
2525
path: dd-trace-js
2626
- name: Pack dd-trace-js
27-
run: mkdir -p ./binaries && echo /binaries/$(npm pack --pack-destination ./binaries ./dd-trace-js) > ./binaries/nodejs-load-from-npm
27+
run: mkdir -p ./binaries && echo /binaries/$(npm pack --silent --pack-destination ./binaries ./dd-trace-js) > ./binaries/nodejs-load-from-npm
2828
- name: Upload artifact
2929
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
3030
with:

‎.github/workflows/update-3rdparty-licenses.yml‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,8 @@ name: Update 3rd-party licenses
33
on:
44
pull_request:
55
paths:
6+
- ".github/vendored-dependencies.csv"
7+
- "vendor/package-lock.json"
68
- "yarn.lock"
79

810
jobs:
@@ -33,8 +35,8 @@ jobs:
3335
- name: Check out dd-license-attribution
3436
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
3537
with:
36-
repository: DataDog/dd-license-attribution
37-
ref: 224a89cb69d3143e8aa4640405037cf9c233ddf5
38+
repository: watson/dd-license-attribution
39+
ref: 8ea483b9f735bf8da632c89796789cc2a050a9a6
3840
path: dd-license-attribution
3941

4042
- name: Install dd-license-attribution
@@ -67,7 +69,7 @@ jobs:
6769
--use-mirrors=mirrors.json \
6870
--no-scancode-strategy \
6971
--no-github-sbom-strategy \
70-
--yarn-subdir vendor \
72+
--lockfile-subdir vendor \
7173
"${REPOSITORY_URL}" > LICENSE-3rdparty.csv
7274
7375
- name: Append vendored dependencies from PR

0 commit comments

Comments
 (0)