chore: bring back yarn.lock (#198)

- [x] no longer schedule workflows daily - [x] bring back yarn lock - [x] use yarn lock in workflows --------- Signed-off-by: Jan Kowalleck <[email protected]>
CycloneDX · Dec 10, 2024 · 591da85 · 591da85
1 parent 29d6fd5
commit 591da85
Show file tree

Hide file tree

Showing 5 changed files with 6,045 additions and 64 deletions.
diff --git a/.github/workflows/nodejs.yml b/.github/workflows/nodejs.yml
@@ -10,9 +10,7 @@ on:
   pull_request:
   workflow_dispatch:
   schedule:
-    # schedule daily tests, since dependencies might not be intended to be locked
-    # this means: at 23:42 every days
-    - cron: '42 23 * * *'
+    - cron: '42 23 * * 5'
 
 concurrency:
   group: '${{ github.workflow }}-${{ github.ref }}'
@@ -25,8 +23,6 @@ env:
   REPORTS_DIR: "CI_reports"
   TESTS_REPORTS_ARTIFACT: tests-reports
   STANDARD_REPORTS_ARTIFACT: cs-reports
-  # we do not ship a lockfile, but yarn tries to protect our non-existing lockfile ... wtf ... disable this fuckup
-  # YARN_ENABLE_HARDENED_MODE: '0'  # https://yarnpkg.com/features/security
 
 jobs:
   build:
@@ -46,9 +42,7 @@ jobs:
       - name: Setup yarn
         run: corepack enable yarn
       - name: Setup subject
-        run: |
-          yarn install --no-immutable
-          yarn info --name-only --recursive
+        run: yarn install --immutable
       - name: build:gbti
         run: yarn run build:gbti
       - name: build:bundle-dev
@@ -71,14 +65,6 @@ jobs:
           path: ${{ env.DIST_DIR }}
           retention-days: 5
           if-no-files-found: error
-      - name: artifact build lock
-        # see https://github.com/actions/upload-artifact
-        uses: actions/upload-artifact@v4
-        with:
-          name: "build-yarn.lock"
-          path: "yarn.lock"
-          retention-days: 5
-          if-no-files-found: error
 
   test-standard:
     name: test standard
@@ -98,9 +84,7 @@ jobs:
       - name: Setup yarn
         run: corepack enable yarn
       - name: Setup subject
-        run: |
-          yarn install --no-immutable
-          yarn info --name-only --recursive
+        run: yarn install --immutable
       - name: build
         run: yarn run build:gbti
       - name: test
@@ -141,9 +125,7 @@ jobs:
       - name: Setup yarn
         run: corepack enable yarn
       - name: Setup subject
-        run: |
-          yarn install --no-immutable
-          yarn info --name-only --recursive
+        run: yarn install --immutable
       - name: build
         run: yarn run build:gbti
       - name: test
@@ -160,12 +142,6 @@ jobs:
       - name: Checkout
         # see https://github.com/actions/checkout
         uses: actions/checkout@v4
-      - name: fetch yarn.lock
-        # see https://github.com/actions/download-artifact
-        uses: actions/download-artifact@v4
-        with:
-          name: "build-yarn.lock"
-          path: "."
       - name: Setup Node.js ${{ env.NODE_ACTIVE_LTS }}
         # see https://github.com/actions/setup-node
         uses: actions/setup-node@v4
@@ -221,12 +197,6 @@ jobs:
       - name: Checkout
         # see https://github.com/actions/checkout
         uses: actions/checkout@v4
-      - name: fetch yarn.lock
-        # see https://github.com/actions/download-artifact
-        uses: actions/download-artifact@v4
-        with:
-          name: "build-yarn.lock"
-          path: "."
       - name: Setup Node.js ${{ matrix.node-version }}
         # see https://github.com/actions/setup-node
         uses: actions/setup-node@v4
@@ -303,7 +273,7 @@ jobs:
           corepack enable yarn
           yarn set version "$YARN_VERSION"
       - name: Setup subject
-        run: yarn install --no-immutable
+        run: yarn install --no-immutable  # we might be changing yarn version for tests -- require to ignore lock
       - name: fetch build artifact
         # see https://github.com/actions/download-artifact
         uses: actions/download-artifact@v4

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -101,9 +101,7 @@ jobs:
       - name: Setup yarn
         run: corepack enable yarn
       - name: Setup subject
-        run: |
-          yarn install --no-immutable
-          yarn info --name-only --recursive
+        run: yarn install --immutable
       - name: build
         run: yarn run build
       - name: artifact build result
@@ -124,14 +122,6 @@ jobs:
           path: ${{ env.DIST_DIR }}
           retention-days: 5
           if-no-files-found: error
-      - name: artifact build lock
-        # see https://github.com/actions/upload-artifact
-        uses: actions/upload-artifact@v4
-        with:
-          name: "build-yarn.lock"
-          path: "yarn.lock"
-          retention-days: 5
-          if-no-files-found: error
 
   test-licenses:
     needs: [ 'build' ]
@@ -171,9 +161,7 @@ jobs:
       - name: Setup yarn
         run: corepack enable yarn
       - name: Setup subject
-        run: |
-          yarn install --no-immutable
-          yarn info --name-only --recursive
+        run: yarn install --immutable
       - name: setup-tests
         run: yarn run setup-tests
       - name: fetch build artifact
@@ -209,13 +197,8 @@ jobs:
           node-version: ${{ env.NODE_ACTIVE_LTS }}
       - name: Setup yarn
         run: corepack enable yarn
-      - name: make lock
-        # for stupid reasons `yarn publish` requires a lockfile
-        run: |
-          yarn workspaces focus --production
-          yarn install --mode update-lockfile
       - name: Set NPM authentication
-        run: yarn config set --home npmAuthToken "$NPM_AUTH_TOKEN"
+        run: yarn config set npmAuthToken "$NPM_AUTH_TOKEN"
         env:
           NPM_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
       - name: publish to registry as "${{ env.NPMJS_RELEASE_TAG }}"
@@ -260,12 +243,6 @@ jobs:
         with:
           name: ${{ env.DIST_DIR }}
           path: ${{ env.DIST_DIR }}
-      - name: fetch yarn.lock
-        # see https://github.com/actions/download-artifact
-        uses: actions/download-artifact@v4
-        with:
-          name: "build-yarn.lock"
-          path: "build-yarn.lock"
       - name: prepare assets
         run: |
           set -exu
@@ -274,8 +251,7 @@ jobs:
           "$PACKED_DIR"/*.tgz \
           "$DIST_DIR/yarn-plugin-cyclonedx.cjs" \
           "$DIST_DIR/LICENSE" \
-          "$DIST_DIR/NOTICE" \
-          "build-yarn.lock/yarn.lock"
+          "$DIST_DIR/NOTICE"
       - name: Create Release
         id: release
         # see https://github.com/softprops/action-gh-release

diff --git a/.gitignore b/.gitignore
@@ -17,7 +17,6 @@ _tmp/
 /.pnp.*
 /.yarn/
 /.yarnrc.yml
-/yarn.lock
 
 
 # Only used during production build.

diff --git a/renovate.json5 b/renovate.json5
@@ -10,6 +10,9 @@
   "labels": [
     "dependencies"
   ],
+  "lockFileMaintenance": {
+    "enabled": true,
+  },
   "ignorePaths": [
     "tests/_data/testbeds/**",
   ],
-Original file line number
+Diff line change
@@ Expand Up / @@ -17,7 +17,6 @@ _tmp/ @@
     /.pnp.*
     /.yarn/
     /.yarnrc.yml
-    /yarn.lock
     # Only used during production build.
@@ Expand Down @@