ci(template): verify lockfile uses only public npm registry#444
Merged
Conversation
Add a required CI check that fails if template/package-lock.json resolves any dependency from a non-public registry. The template ships to users via `databricks apps init`, so a private/internal registry leaking into the lockfile (e.g. from a regen on a machine with a custom .npmrc) would break or silently redirect `npm install` in scaffolded apps. The new tools/check-template-lock-registry.ts requires every `resolved` URL to be https on registry.npmjs.org (which also rejects git/file/http sources) and, if a template/.npmrc is ever added, flags private registry/auth lines. Wired into the existing lint_and_typecheck job next to check-template-deps. Signed-off-by: MarioCadenas <MarioCadenas@users.noreply.github.com>
Temporarily points clsx and lucide-react resolved URLs at npm-proxy.dev.databricks.com to confirm the new check-template-lock-registry CI step fails. Reverted immediately after. Signed-off-by: MarioCadenas <MarioCadenas@users.noreply.github.com>
Restores clsx and lucide-react resolved URLs to registry.npmjs.org after confirming the check-template-lock-registry CI step failed as expected. Signed-off-by: MarioCadenas <MarioCadenas@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Adds a required CI check that fails if
template/package-lock.jsonresolves any dependency from a non-public registry.Why
The
template/directory is the app scaffold shipped to users viadatabricks apps init, and itspackage-lock.jsonpins exactly where each dependency is fetched from (theresolvedfield on every package entry). If a private/internal registry (Artifactory, JFrog, GitHub Packages, Verdaccio, an internal mirror) ever leaks into that lockfile — for example because it was regenerated on a machine with a custom.npmrc— scaffolded apps would either failnpm install(no access) or silently pull from a non-public source.Today the lockfile is clean (1003
resolvedentries, allhttps://registry.npmjs.org/), but nothing enforced it. This check closes that gap.How
New
tools/check-template-lock-registry.ts(follows the existingcheck-template-deps.tspattern):packagesmap oftemplate/package-lock.json(lockfileVersion 3) and requires everyresolvedURL to behttps://with hostregistry.npmjs.org. Entries withoutresolved(root + workspace/link) are skipped. The single https+host rule also rejects non-registry sources likegit+ssh://,file:, andhttp://.template/.npmrcis ever added (none exists today), flags any privateregistry=/scoped-registry line or_authToken=line; absence is handled silently.Wired as a new step in the existing required
lint_and_typecheckjob, next tocheck-template-deps, so it runs on every PR and blocks merge.Verification
git+ssh://entry → both flagged, exit 1..npmrcregistry=/_authToken=flagged; legitimate@scope:registry=https://registry.npmjs.org/not flagged → exit 1..npmrc→ exit 0, no error.