From 50ae954ebfe43a79b975aeedd0dfed6e47f7b7f4 Mon Sep 17 00:00:00 2001 From: imccyu Date: Wed, 5 Aug 2026 01:01:33 +0800 Subject: [PATCH] fix(npm): publish vendored baseline packages --- scripts/publish-npm-baseline.ts | 60 ++++++++++++++++++++++----------- 1 file changed, 41 insertions(+), 19 deletions(-) diff --git a/scripts/publish-npm-baseline.ts b/scripts/publish-npm-baseline.ts index 096fa6f246..b863056b3f 100644 --- a/scripts/publish-npm-baseline.ts +++ b/scripts/publish-npm-baseline.ts @@ -22,7 +22,11 @@ import { validateTarballPayload } from './publication-payload.ts' const DEFAULT_REGISTRY = 'https://registry.npm.harnessment.com' const DEFAULT_OUTPUT_DIRECTORY = '.artifacts/npm-baseline' -const PACKAGE_PATTERNS = ['packages/*/*/package.json', 'apps/*/package.json'] as const +const PACKAGE_PATTERNS = [ + 'vendor/*/package.json', + 'packages/*/*/package.json', + 'apps/*/package.json', +] as const const DEPENDENCY_SECTIONS = [ 'dependencies', 'devDependencies', @@ -101,13 +105,17 @@ interface CommandResult { interface PackageTarget { name: string directory: string + origin: PackageOrigin } +type PackageOrigin = 'harness' | 'vendor' + interface PackedPackage { name: string tarball: string sha256: string integrity: string + origin: PackageOrigin } interface ReleaseManifest { @@ -237,7 +245,7 @@ class DetachedWorktree { } } -/** Discovers and stages only two-level package entries and application entries. */ +/** Discovers and stages every package published in one repository baseline. */ class WorkspacePackageSet { private constructor( readonly packages: PackageTarget[], @@ -246,33 +254,38 @@ class WorkspacePackageSet { static discover(root: string): WorkspacePackageSet { const manifestPaths = globSync(PACKAGE_PATTERNS, { cwd: root }).sort() - if (manifestPaths.length === 0) throw new Error('no package manifests found under packages/ or apps/') + if (manifestPaths.length === 0) { + throw new Error('no package manifests found under vendor/, packages/, or apps/') + } const packages: PackageTarget[] = [] const names = new Set() - let baseVersion: string | undefined + const baseVersion = expectString(readObject(resolve(root, 'package.json')), 'version', 'package.json') + if (!/^\d+\.\d+\.\d+$/.test(baseVersion)) { + throw new Error(`package.json must have a stable X.Y.Z version, got ${baseVersion}`) + } for (const manifestPath of manifestPaths) { const manifest = readObject(resolve(root, manifestPath)) const name = expectString(manifest, 'name', manifestPath) const version = expectString(manifest, 'version', manifestPath) - if (!name.startsWith('@deepseek-ai/')) { + const isVendored = manifestPath.startsWith('vendor/') + if (!isVendored && !name.startsWith('@deepseek-ai/')) { throw new Error(`${manifestPath} must name an @deepseek-ai package`) } if (name === '@deepseek-ai/dsh-root') { throw new Error(`${manifestPath} unexpectedly selected the workspace root`) } if (names.has(name)) throw new Error(`duplicate package name: ${name}`) - if (!/^\d+\.\d+\.\d+$/.test(version)) { - throw new Error(`${manifestPath} must have a stable X.Y.Z version, got ${version}`) - } - baseVersion ??= version - if (version !== baseVersion) { + if (!isVendored && version !== baseVersion) { throw new Error(`${manifestPath} has version ${version}; expected ${baseVersion}`) } names.add(name) - packages.push({ name, directory: dirname(manifestPath) }) + packages.push({ + name, + directory: dirname(manifestPath), + origin: isVendored ? 'vendor' : 'harness', + }) } - if (baseVersion === undefined) throw new Error('could not determine the workspace version') packages.sort((left, right) => left.name.localeCompare(right.name)) return new WorkspacePackageSet(packages, baseVersion) } @@ -307,16 +320,18 @@ class ReleaseBundle { runner: CommandRunner, ): ReleaseBundle { const internalNames = new Set(expectedPackages.map(pkg => pkg.name)) + const expectedByName = new Map(expectedPackages.map(pkg => [pkg.name, pkg])) const missingNames = new Set(internalNames) const packages = readdirSync(directory) .filter(name => name.endsWith('.tgz')) .sort() .map((tarball) => { const artifact = inspectTarball(resolve(directory, tarball), runner) - validateTarballPayload(artifact.files, tarball) - if (!missingNames.delete(artifact.name)) { + const expected = expectedByName.get(artifact.name) + if (expected === undefined || !missingNames.delete(artifact.name)) { throw new Error(`unexpected or duplicate packed package: ${artifact.name}`) } + if (expected.origin === 'harness') validateTarballPayload(artifact.files, tarball) if (artifact.version !== version) { throw new Error(`${tarball} has version ${artifact.version}; expected ${version}`) } @@ -325,7 +340,7 @@ class ReleaseBundle { throw new Error(`${tarball} still contains a workspace: dependency`) } validateInternalDependencyPins(artifact.manifest, internalNames, version, tarball) - return packedPackage(artifact.name, resolve(directory, tarball)) + return packedPackage(artifact.name, resolve(directory, tarball), expected.origin) }) .sort((left, right) => left.name.localeCompare(right.name)) @@ -385,12 +400,12 @@ class ReleaseBundle { throw new Error(`invalid tarball path for ${pkg.name}: ${pkg.tarball}`) } const path = resolve(this.directory, pkg.tarball) - const actual = packedPackage(pkg.name, path) + const actual = packedPackage(pkg.name, path, pkg.origin) if (actual.sha256 !== pkg.sha256 || actual.integrity !== pkg.integrity) { throw new Error(`tarball checksum mismatch: ${pkg.tarball}`) } const artifact = inspectTarball(path, runner) - validateTarballPayload(artifact.files, pkg.tarball) + if (pkg.origin === 'harness') validateTarballPayload(artifact.files, pkg.tarball) if (artifact.name !== pkg.name || artifact.version !== this.manifest.version) { throw new Error(`tarball identity mismatch: ${pkg.tarball}`) } @@ -565,6 +580,7 @@ class BaselinePackager { this.runner.run('pnpm', ['run', 'publint'], worktree.path) this.runner.run('pnpm', ['run', 'verify-built-package-invariants'], worktree.path) this.runner.run('pnpm', [ + '--filter', './vendor/**', '--filter', './packages/**', '--filter', './apps/**', '--recursive', @@ -765,13 +781,14 @@ function inspectTarball(path: string, runner: CommandRunner): InspectedTarball { } } -function packedPackage(name: string, path: string): PackedPackage { +function packedPackage(name: string, path: string, origin: PackageOrigin): PackedPackage { const bytes = readFileSync(path) return { name, tarball: basename(path), sha256: createHash('sha256').update(bytes).digest('hex'), integrity: `sha512-${createHash('sha512').update(bytes).digest('base64')}`, + origin, } } @@ -779,7 +796,11 @@ function parsePackedPackage(value: unknown, index: number): PackedPackage { if (!isRecord(value)) throw new Error(`invalid release manifest package at index ${index}`) const context = `release manifest package at index ${index}` const name = expectString(value, 'name', context) - if (!name.startsWith('@deepseek-ai/') || name === '@deepseek-ai/dsh-root') { + const origin = value.origin === undefined ? 'harness' : value.origin + if (origin !== 'harness' && origin !== 'vendor') { + throw new Error(`invalid package origin in release manifest: ${JSON.stringify(origin)}`) + } + if (origin === 'harness' && (!name.startsWith('@deepseek-ai/') || name === '@deepseek-ai/dsh-root')) { throw new Error(`invalid package name in release manifest: ${name}`) } return { @@ -787,6 +808,7 @@ function parsePackedPackage(value: unknown, index: number): PackedPackage { tarball: expectString(value, 'tarball', context), sha256: expectString(value, 'sha256', context), integrity: expectString(value, 'integrity', context), + origin, } }