Add pnpm fixture + test-pnpm integration job#9
Merged
Conversation
The npm fixture mirrors the existing python/ and container/ shape: a single-package, no-dependency project that exercises wrangle's build_and_publish_npm.yml end-to-end (build, SBOM, hash, gate, provenance, verify). Publish is intentionally NOT wired up — npm Trusted Publishing cannot mint a package's first version (npm/cli#8544) and the trusted publisher needs to be registered on npmjs.com first. Both are human-only bootstrap steps. The package-lock.json is hand-written (lockfileVersion 3, no deps) so no npm install is needed. The package name is the stable name we'll eventually register Trusted Publishing against.
Without a dep, npm ci is a no-op and the syft SBOM only sees the root package, so we're not actually exercising those code paths. ms@2.1.3 is a stable, zero-transitive-dep, ~5KB pure-JS package (no native code) — enough to make the SBOM meaningful and verify npm ci installs from the lockfile, without dragging in a dep tree that adds lockfile churn. Lockfile generated by `npm install` (npm 10.9.7 / node v22.22.2).
Adds a parallel pnpm/ fixture exercising wrangle's pnpm tooling branch end-to-end through build_and_publish_npm.yml: Corepack-driven pnpm activation, `pnpm install --frozen-lockfile`, `pnpm pack`, SBOM, hash computation, SLSA generic provenance, and slsa-verifier verification. The pnpm fixture reuses the existing @tomhennen/wrangle-integration-fixture package name so no new Trusted Publisher registration is needed on npmjs.com. It's intentionally build-only — publish-to-npmjs.org is already covered by test-npm via the same package name, and doing the publish twice in one run would race on the `--tag integration` version. Mirrors test-python-uv's "double up coverage on one fixture" pattern (uv tooling + verify-opt-out on a single fixture). The lockfile is generated by pnpm 9.15.4 against ms@2.1.3 — same single zero-transitive-dep package as npm/, so the pnpm path exercises the same SBOM/integrity machinery as the npm path. The `packageManager` field pins the pnpm version Corepack activates deterministically. Pairs with TomHennen/wrangle#212 (pnpm support in the npm build type).
The npm/package.json on this branch is missing the repository field added on main in c88dc12 (Trusted Publishing provenance check requires it), and the container-no-verify/ fixture added on main in 0fb46a4 isn't here either. Both predate the pnpm work but were absent because this branch forked before they landed. Pushing main's current content for these paths avoids the pnpm PR diff showing spurious "reverts" of those changes.
…ure-1h6Sv # Conflicts: # .github/workflows/test-wrangle.yml.template # container-no-verify/app.sh
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Pairs with TomHennen/wrangle#212 (pnpm support in the npm build type). Adds an integration fixture that exercises wrangle's new pnpm path end-to-end: Corepack-driven pnpm activation,
pnpm install --frozen-lockfile,pnpm pack, SBOM, hash computation, SLSA generic provenance, slsa-verifier verification.The fixture reuses the existing
@tomhennen/wrangle-integration-fixturepackage name fromnpm/so no new Trusted Publisher registration is needed on npmjs.com. Build-only — publish coverage already comes fromtest-npmagainst the same package.What's in the diff
pnpm/package.json— same package name asnpm/, withpackageManager: "pnpm@9.15.4"to pin Corepack's pnpm download deterministically. Singlems@^2.1.3dependency (matchesnpm/for parity).pnpm/index.js— single-linemodule.exports = require('ms'), mirroringnpm/index.js.pnpm/pnpm-lock.yaml— pnpm lockfile v9.0 withms@2.1.3pinned by integrity hash. Generated locally with pnpm 9.15.4 against the samemsversionnpm/package-lock.jsonpins, so the pnpm path exercises the same bytes through a different package manager..github/workflows/test-wrangle.yml.template— adds atest-pnpmjob aftertest-npm. No prep step (no per-run version bump because we don't publish from this job). Permissions matchtest-npm(slsa-github-generator demands them at startup even when the upload-assets job is gated off).npm/package.jsonrepository field,container-no-verify/files) — this branch forked before c88dc12 / 0fb46a4 landed on main. Synced them in the first commit on this PR so the visible diff is just the pnpm work, not spurious reverts. Functionally a no-op against main.Security review
pnpm install --frozen-lockfileaborts on lockfile drift. The lockfile pinsms@2.1.3with the npm registry's integrity hash; pnpm refuses to install if the resolved bytes don't match.scriptsfield inpackage.json. Nothing for--ignore-scriptsto suppress, no lifecycle hooks to attest. The L3 attestation binds purely to source bytes.files: ["index.js"]restricts whatpnpm packincludes. No accidental inclusion ofnode_modules/, scripts, dotfiles, etc.packageManager: "pnpm@9.15.4"— Corepack downloads pnpm from the npm registry on first activation and verifies it against the registry's signed metadata. Same trust chain asnpm install. Bumping pnpm requires regenerating the lockfile.test-pnpm. NoNPM_TOKEN, no OIDC handshake, noid-token: writeconsumption beyond whatslsa-github-generatorneeds internally. Doubling up the publish from two jobs on the same package name in one run would race for the same--tag integrationversion — keeping it build-only is the safe shape.secrets:block ontest-pnpm. Doesn't inherit caller secrets it doesn't need.ref:input.test-pnpmreadsgithub.sha(the triggering commit) —pnpm/isn't rewritten by any prep job, so we want the original triggering SHA, which is wrangle's npm reusable workflow default whenrefis empty.packageManagerfield is the only thing Corepack needs from the adopter. Nopnpm.npmrcor environment overrides shipped. Means an adopter cloning this fixture as a template gets the same trust shape.Test plan
check-changescan): zizmor + osv clean.claude/v0.2-pnpm-supportbranch (= PR v0.2: pnpm support in npm build type (single-package only) wrangle#212) — confirmtest-pnpmpasses end-to-end.test-pnpmskips publish (nopublish-pnpmjob exists) and the published@tomhennen/wrangle-integration-fixture@integrationversions only come frompublish-npm.Related
https://claude.ai/code/session_01AqkojrFQsx5CgHGndN96E2
Generated by Claude Code