workspace-lockfile-importer-guard: Workspace Lockfile Importer Guard #3
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "task/workspace-lockfile-importer-guard"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Assigned idea
Benchmark authoring specification.
Summary: Add a repo-local Node check that ensures Skylight's PNPM lockfile importers stay synchronized with the workspace packages and reports missing or extra importer entries deterministically.
Task intent: Skylight maintainers need a fast consistency check for the PNPM monorepo so the importers for ., server, shared, tracker, and web do not drift from the workspace layout before dependency updates are committed.
Benchmark plan: Construct the package as an upstream maintainer request to add a lockfile importer validation script and wire it into the root package scripts. The hidden tests should use the real pnpm-lock.yaml as the passing case, then copy the repo to temporary directories and mutate pnpm-lock.yaml by removing tracker and by adding a bogus ghost importer to confirm useful failures.
Environment plan: Environment/repo: use cpaczek/skylight at the fixed commit with its existing Node/PNPM workspace and lockfile; do not require browsers, services, or optional native packages. Task/environment: run a lightweight Python verifier that invokes Node directly, creates temporary mutated lockfile copies, and avoids network access after dependencies are available.
Verifier plan: test_outputs.py should assert that scripts/check-pnpm-importers.mjs exists, root package.json exposes a check:workspace-lock script invoking it, node scripts/check-pnpm-importers.mjs exits 0 on the unmodified repo, removing the tracker importer from a temp pnpm-lock.yaml exits nonzero with tracker and pnpm-lock.yaml in output, and adding a ghost importer exits nonzero with ghost in output.
Oracle plan: The oracle solution adds scripts/check-pnpm-importers.mjs using only Node built-ins. It parses pnpm-workspace.yaml or equivalent workspace package declarations, adds . as the root importer, parses the lockfile importers section, compares sorted sets, and prints clear missing/extra importer diagnostics. It adds a root package.json script such as check:workspace-lock without changing pnpm-lock.yaml or adding dependencies.
Difficulty plan: Coding assistants may hard-code only the current happy path, forget the . root importer, parse YAML indentation incorrectly, mutate the lockfile instead of validating it, add unnecessary dependencies that change the lockfile, or fail to produce stable diagnostics for hidden mutated cases.
Repo patch scope: Expected edits are limited to scripts/check-pnpm-importers.mjs and the root package.json scripts section. Do not edit application code under server/, shared/, tracker/, or web/, and do not modify pnpm-lock.yaml.
Anti-leakage notes: Solver-facing materials must not mention benchmark, harness, Snorkel, Harbor, std-ts, agent, stage, attempt, retry, generated task, or evaluation context; present it only as a Skylight maintainer request.
Approach: Ask the solver to implement a maintainers' check command, keep it dependency-free, compare workspace package names against pnpm-lock.yaml importers, and emit actionable errors naming missing and extra importers.
Verification: Run python test_outputs.py; it will inspect package.json and scripts/check-pnpm-importers.mjs, then execute node scripts/check-pnpm-importers.mjs on the original and mutated pnpm-lock.yaml copies.
Risk: If the repo uses an unusual workspace declaration format, the author should adapt the hidden verifier to the actual file while keeping the same observable behavior. Avoid tests that depend on optional onnxruntime-node installation or platform-specific native packages.
Path rules: task package is tasks/; mutable upstream checkout is tasks//environment/repo; benchmark package files are under tasks//task; verifier/container environment belongs under tasks//task/environment; regular and UI verifier logic belongs in task/tests/test_outputs.py and test.sh only runs that file through pytest.
Agent context
Task slug: workspace-lockfile-importer-guard
Branch: task/workspace-lockfile-importer-guard
View command line instructions
Checkout
From your project repository, check out a new branch and test the changes.Merge
Merge the changes and update on Forgejo.Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.