Skip to content

Commit 0934e07

Browse files
Ubuntuedvincent
Ubuntu
authored and
edvincent
committed
Generate shrinkwrap file for deterministic dependencies
1 parent 61673b5 commit 0934e07

File tree

5 files changed

+58
-175
lines changed

5 files changed

+58
-175
lines changed

‎ci/build/build-release.sh

-10
Original file line numberDiff line numberDiff line change
@@ -56,16 +56,6 @@ EOF
5656
) > "$RELEASE_PATH/package.json"
5757
rsync yarn.lock "$RELEASE_PATH"
5858

59-
# To ensure deterministic dependency versions (even when code-server is installed with NPM), we seed
60-
# an npm-shrinkwrap file from our yarn lockfile and the current node-modules installed.
61-
synp --source-file yarn.lock
62-
npm shrinkwrap
63-
# HACK@edvincent: The shrinkwrap file will contain the devDependencies, which by default
64-
# are installed if present in a lockfile. To avoid every user having to specify --production
65-
# to skip them, we carefully remove them from the shrinkwrap file.
66-
json -f npm-shrinkwrap.json -I -e "Object.keys(this.dependencies).forEach(dependency => { if (this.dependencies[dependency].dev) { delete this.dependencies[dependency] } } )"
67-
mv npm-shrinkwrap.json "$RELEASE_PATH"
68-
6959
rsync ci/build/npm-postinstall.sh "$RELEASE_PATH/postinstall.sh"
7060

7161
if [ "$KEEP_MODULES" = 1 ]; then

‎ci/build/build-standalone-release.sh

+24-1
Original file line numberDiff line numberDiff line change
@@ -28,8 +28,31 @@ main() {
2828
ln -s "./lib/node" "$RELEASE_PATH/node"
2929

3030
pushd "$RELEASE_PATH"
31-
yarn --production --frozen-lockfile
31+
yarn --frozen-lockfile
32+
create_shrinkwraps
3233
popd
3334
}
3435

36+
create_shrinkwraps() {
37+
# yarn.lock or package-lock.json files (used to ensure deterministic versions of dependencies) are
38+
# not packaged when publishing to the NPM registry.
39+
# To ensure deterministic dependency versions (even when code-server is installed with NPM), we create
40+
# an npm-shrinkwrap.json file from the currently installed node_modules. This ensures the versions used
41+
# from development (that the yarn.lock guarantees) are also the ones installed by end-users.
42+
43+
# We first generate the shrinkwrap file for code-server itself - from being in $RELEASE_PATH
44+
npm shrinkwrap
45+
46+
# Then the shrinkwrap files for the bundled VSCode
47+
# We don't need to remove the devDependencies for these because we control how it's installed - and
48+
# as such we can force not installing the devDependencies
49+
cd lib/vscode/
50+
npm shrinkwrap
51+
52+
cd extensions/
53+
npm shrinkwrap
54+
55+
cd ../../
56+
}
57+
3558
main "$@"

‎ci/build/npm-postinstall.sh

+31-4
Original file line numberDiff line numberDiff line change
@@ -110,7 +110,7 @@ main() {
110110
echo "Failed to download cloud agent; --link will not work"
111111
fi
112112

113-
if ! vscode_yarn; then
113+
if ! vscode_install; then
114114
echo "You may not have the required dependencies to build the native modules."
115115
echo "Please see https://github.com/coder/code-server/blob/main/docs/npm.md"
116116
exit 1
@@ -123,17 +123,44 @@ main() {
123123
fi
124124
}
125125

126-
vscode_yarn() {
126+
install_with_yarn_or_npm() {
127+
# NOTE@edvincent: We want to keep using the package manager that the end-user was using to install the package.
128+
# This also ensures that when *we* run `yarn` in the development process, the yarn.lock file is used.
129+
case "${npm_config_user_agent-}" in
130+
yarn*)
131+
if [ -f "yarn.lock" ]; then
132+
yarn --production --frozen-lockfile --no-default-rc
133+
else
134+
echo "yarn.lock file not present, not running in development mode. use npm should be used to install code-server!"
135+
exit 1
136+
fi
137+
;;
138+
npm*)
139+
if [ -f "yarn.lock" ]; then
140+
echo "yarn.lock file present, running in development mode. use yarn to install code-server!"
141+
exit 1
142+
else
143+
npm install --omit=dev
144+
fi
145+
;;
146+
*)
147+
echo "Could not determine which package manager is being used to install code-server"
148+
exit 1
149+
;;
150+
esac
151+
}
152+
153+
vscode_install() {
127154
echo 'Installing Code dependencies...'
128155
cd lib/vscode
129-
yarn --production --frozen-lockfile --no-default-rc
156+
install_with_yarn_or_npm
130157

131158
symlink_asar
132159
symlink_bin_script remote-cli code code-server
133160
symlink_bin_script helpers browser browser .sh
134161

135162
cd extensions
136-
yarn --production --frozen-lockfile
163+
install_with_yarn_or_npm
137164
}
138165

139166
main "$@"

‎package.json

+1-4
Original file line numberDiff line numberDiff line change
@@ -59,13 +59,11 @@
5959
"eslint-import-resolver-typescript": "^2.5.0",
6060
"eslint-plugin-import": "^2.18.2",
6161
"eslint-plugin-prettier": "^4.0.0",
62-
"json": "^11.0.0",
6362
"prettier": "^2.2.1",
6463
"prettier-plugin-sh": "^0.12.0",
6564
"shellcheck": "^1.0.0",
6665
"stylelint": "^13.0.0",
6766
"stylelint-config-recommended": "^5.0.0",
68-
"synp": "^1.9.10",
6967
"ts-node": "^10.0.0",
7068
"typescript": "^4.6.2"
7169
},
@@ -108,8 +106,7 @@
108106
"semver": "^7.1.3",
109107
"split2": "^4.0.0",
110108
"ws": "^8.0.0",
111-
"xdg-basedir": "^4.0.0",
112-
"yarn": "^1.22.4"
109+
"xdg-basedir": "^4.0.0"
113110
},
114111
"bin": {
115112
"code-server": "out/node/entry.js"

0 commit comments

Comments
 (0)