feat(node-ci): forward cache-dependency-path to setup-node#19
Conversation
Polyglot repos with a lockfile outside the repo root (e.g. viz's `src/ResQ.Viz.Web/package-lock.json`) couldn't adopt this reusable — actions/setup-node bailed with "Dependencies lock file is not found" because the reusable didn't accept a `cache-dependency-path` input. Changes: - node-ci.yml: add optional `cache-dependency-path` input, forward to the setup-node step. Default empty preserves current behaviour. - required.yml: add pass-through `node-cache-dependency-path` input so consumers routing through the org aggregator can set it. Surfaced during resq-software/viz PR #58 adoption attempt. Viz's client pipeline currently uses a hand-rolled inline job because of this gap — once this lands + the viz ref pin bumps, it can switch to the shared reusable. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
Note Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported. |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (2)
📝 WalkthroughWalkthroughGitHub Actions workflow files updated to support flexible Node.js dependency lockfile path configuration. Added Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~8 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
* ci: switch client job to node-ci.yml reusable (org PR #19 landed) Swap the hand-rolled frontend install+typecheck+build steps for the org-wide node-ci.yml reusable. The prior adoption attempt failed with "Dependencies lock file is not found" because the reusable hardcoded `cache-dependency-path: package-lock.json` (repo root) — viz's lockfile lives at src/ResQ.Viz.Web/package-lock.json. resq-software/.github#19 parameterised `cache-dependency-path` on the reusable; this PR consumes the merged SHA. Call node-ci.yml directly rather than via required.yml because viz already calls required.yml as `lang: dotnet` for the backend stream; a second `lang: node` dispatch would duplicate the security-scan job. client-budget stays as a companion — the reusable exposes neither bundle outputs nor artifact upload, and the bundle-size ceiling is viz-specific policy. Ref pinned to merge commit 23ce94eabddf963835624451e89baca7ac9db541. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * deps: force uuid to ^14 via override (GHSA-w5hq-g745-h8pq) osv-scanner surfaced GHSA-w5hq-g745-h8pq (medium) against uuid@13.0.0, pulled transitively through effect@4.0.0-beta.52 → uuid: ^13.0.0. effect hasn't bumped its caret yet. Add a top-level npm `overrides` entry to force uuid@^14.0.0. uuid's public surface (v4()/validate()/parse()) is unchanged across the 13→14 major, so effect's usage is unaffected. Lockfile regenerated; typecheck + vite build both clean. Bundle size unchanged (776 KB JS, within 800 KB budget). This is an unrelated advisory bundled here only because it landed in osv.dev between main's last build and this branch, and the gate now blocks the CI-reusable-adoption signal we're verifying. Remove the override once `effect` upstream bumps its `uuid: ^13.0.0` range. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Summary
Polyglot repos with a lockfile outside the repo root couldn't adopt this reusable —
actions/setup-nodebailed withDependencies lock file is not foundbecause the reusable didn't accept acache-dependency-pathinput.Surfaced during
resq-software/vizPR #58 adoption attempt. Viz's client pipeline (src/ResQ.Viz.Web/package-lock.json) currently uses a hand-rolled inline job because of this gap; once this lands + the viz ref pin bumps, it can switch to the shared reusable.Changes
node-ci.ymlcache-dependency-path: string(default"").actions/setup-nodestep'scache-dependency-pathkey.required.ymlnode-cache-dependency-pathso consumers routing through the org aggregator (most of them) can set it.Backwards compatibility
Default is
"". When unset,actions/setup-nodetreats the key as absent and falls back to repo-root lockfile detection — exactly the pre-PR behaviour. No current consumer needs updating; this only enables new adoption patterns.Verification
ruby -ryamlparses both YAMLs after the changenode-ci.ymlinputs:[... working-directory, cache-dependency-path, install-cmd, ...]required.ymlnode-* inputs:[..., node-build-cmd, node-cache-dependency-path]Test plan (follow-up in viz)
Once merged, viz's
ci.ymlcan switch from the hand-rolled client job to:🤖 Generated with Claude Code
Summary by CodeRabbit