ci(phase2): replace install.js postinstall with per-platform npm packages - #1246
Open
kbarnold wants to merge 5 commits into
Open
ci(phase2): replace install.js postinstall with per-platform npm packages#1246kbarnold wants to merge 5 commits into
kbarnold wants to merge 5 commits into
Conversation
…ackages - Rewrite bin/mbt to resolve the platform binary via require.resolve on @sap/mbt-<os>-<arch> instead of looking in unpacked_bin/ - Delete install.js (postinstall network download) and index.js (empty stub) - Remove axios/tar/unzip-stream dependencies - Remove the "install" postinstall script from package.json - Rename package from "mbt" to "@sap/mbt", set version placeholder "0.0.0-dev" - Add optionalDependencies for the five per-platform packages (versions are 0.0.0-dev placeholders; the publish workflow overwrites them at release time) - Remove install.js and index.js from the "files" list Consumer install behavior is unchanged: npm install @sap/mbt still works and selects the correct platform binary. No postinstall network call.
…ckages
- .github/publish/npm/mbt-wrapper/package.json.tmpl — wrapper package
template; {{.Version}} is substituted at publish time
- .github/publish/npm/mbt-platform/package.json.tmpl — per-platform
package template; substitutes Version, Os, Arch, BinExt
- .github/scripts/render-npm-packages.sh — renders templates and copies
goreleaser-built binaries into /tmp/publish/<pkg>/ ready for npm publish
The render script is called by the release-publish workflow (Phase 4).
It can also be run locally against a goreleaser snapshot build for dry-run
testing (step 11 of Phase 2).
…overy - Add required `version: 2` header to .goreleaser.yml (goreleaser v2+) - Replace deprecated `archives.replacements` with `name_template` using the title filter to preserve Darwin/Linux/Windows capitalisation - Fix render-npm-packages.sh to locate binaries via find rather than constructing the path, since goreleaser v2 uses project_name as the directory prefix (cloud-mta-build-tool_linux_amd64_v1/) not binary name - Fix PLATFORMS table to use an indexed array to avoid associative array unbound variable errors on some bash versions Smoke tested: goreleaser build --snapshot + render script + npm install + mbt --version all pass on darwin/arm64.
Removes the old axios/tar/unzip-stream lock entries; now only the @sap/mbt wrapper metadata is tracked. optionalDependencies remain at 0.0.0-dev placeholders until the publish workflow stamps the real version.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
install.jspostinstall script (which downloaded binaries from GitHub Releases at install time) with per-platform optional npm packages (@sap/mbt-linux-x64,@sap/mbt-linux-arm64,@sap/mbt-darwin-x64,@sap/mbt-darwin-arm64,@sap/mbt-win32-x64)bin/mbtto userequire.resolveto locate the platform binary shipped in the appropriate optional package.github/publish/npm/) and a render script (.github/scripts/render-npm-packages.sh) that the release workflow will use to prepare and publish all 6 packages (5 platform + 1 wrapper) after goreleaser builds the binaries.goreleaser.ymlto goreleaser v2 format (version: 2,name_templatereplacing removedarchives.replacements)axios,tar,unzip-streamdependencies;package-lock.jsondrops from 440 to 22 linesMotivation
The
install.jsapproach downloads unverified binaries at install time over HTTPS, which is a supply-chain risk vector. The per-platform package approach ships signed, checksummed binaries through the npm registry (same channel as the package itself), which is safer and works offline/air-gapped after install.Test plan
goreleaser build --snapshot --clean→render-npm-packages.sh→npm installwrapper + platform tarball →node_modules/.bin/mbt --versionprints correct version