Repository navigation
root - chore: defense - block exotic subdependencies - #165
Conversation
blockExoticSubdeps fails the install when a subdependency uses a non-registry source. Co-authored-by: Jared Wray <me@jaredwray.com>
The checklist names the open pull request. Co-authored-by: Jared Wray <me@jaredwray.com>
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #165 +/- ##
=========================================
Coverage 100.00% 100.00%
=========================================
Files 9 9
Lines 639 639
Branches 146 151 +5
=========================================
Hits 639 639 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request enables the "blockExoticSubdeps" setting in "pnpm-workspace.yaml" and updates the defense-in-depth documentation. A review comment points out that the checklist item for "blockExoticSubdeps" in "DEFENSE_IN_DEPTH.md" should be marked as completed rather than pending, since it is being enabled in this PR.
| - [ ] Lifecycle scripts blocked: `strictDepBuilds: true`, `dangerouslyAllowAllBuilds: false`, `allowBuilds: {}` baseline (PR #164 pending) | ||
| - [ ] `blockExoticSubdeps: true` | ||
| - [x] Lifecycle scripts blocked: `strictDepBuilds: true`, `dangerouslyAllowAllBuilds: false`, `allowBuilds: {}` baseline — PR #164 | ||
| - [ ] `blockExoticSubdeps: true` (PR #165 pending) |
There was a problem hiding this comment.
Since this pull request is enabling blockExoticSubdeps: true in pnpm-workspace.yaml, this checklist item should be marked as completed ([x]) to accurately reflect the state of the repository once this PR is merged.
There was a problem hiding this comment.
The item stays open until the change is on main. DEFENSE_IN_DEPTH.md line 23 records (PR #165 pending) for that reason. The next defense pull request marks the item done after merge. This pull request does not need a follow-up only for the checkbox.
Summary
This pull request sets
blockExoticSubdepsto true in section 3.Status
DEFENSE_IN_DEPTH.md: exotic subdependencies → (PR #165 pending). Lifecycle scripts → PR #164.Verification
pnpm install --frozen-lockfilepasses withblockExoticSubdeps: true.pnpm buildpasses.60c8cb3.Reference
defense-in-depth-nodejs § 3