| 文件 | 最后提交记录 | 最后更新时间 |
|---|---|---|
feat(plugin-npm): allow npmMinimalAgeGate per npmScope (#7156) ## What's the problem this PR addresses? Closes #6984. `npmMinimalAgeGate` is currently a single global setting. In environments that mix a public registry (where the gate is desired for supply-chain protection) with one or more trusted private/internal registries (where freshly published packages must be installable immediately), there is no way to express different policies per scope. Disabling the gate globally is the only workaround, which removes the protection everywhere. ## How did you fix it? Allow `npmMinimalAgeGate` inside an `npmScopes` entry, falling back to the global value when unset: ```yaml npmMinimalAgeGate: 1d npmScopes: my-corp: npmRegistryServer: https://npm.pkg.mycompany.com npmMinimalAgeGate: 0 ``` Implementation: - Added `npmMinimalAgeGate` to the `npmScopes` shape (and to `ConfigurationValueMap`) in `packages/plugin-npm/sources/index.ts`. `npmPreapprovedPackages` stays global only. - Introduced `getMinimalAgeGate(ident, {configuration})` in `packages/plugin-npm/sources/npmConfigUtils.ts`. Resolution rule: 1. If the ident has a scope and that scope sets `npmMinimalAgeGate` -> return the scope value. 2. Else -> return the global value. There is no longer any global-specific short-circuit: the scope value always wins when present, including the case where the global is `0` but a scope tightens the gate. - `shouldBeQuarantined` now consults the helper instead of reading the global directly. No public API or call-site signature changes (`ident` was already on `IsPackageApprovedOptions`). - The JSR default scope object does not declare `npmMinimalAgeGate`, so JSR-scoped lookups fall through to the global; no regression. ### \`--no-time-gate\` Previously the CLI flag relied on the \`global === 0\` short-circuit to disable the gate everywhere. With that short-circuit gone, setting the global to \`0\` alone is no longer enough, since each scope carries its own gate (explicit, or the inherited default). The flag now goes through a shared \`suggestUtils.disableTimeGate(configuration)\` helper (used by \`add\` and \`up\`) that: 1. Sets the global \`npmMinimalAgeGate\` to \`0\` via a \`<cli>\` override. 2. Strips \`npmMinimalAgeGate\` from every \`npmScopes\` entry, so the CLI override is the only remaining source of truth. (\`npmMinimalAgeGate\` is not registry-scopable -- it lives on the global config and on \`npmScopes\` only -- so nothing needs to be stripped from \`npmRegistries\`.) Tests (`packages/acceptance-tests/pkg-tests-specs/sources/features/npmMinimalAgeGate.test.ts`) add a new `describe('npmScopes override')` block: 1. Scope override tightens the gate beyond the global value. 2. Scope override loosens the gate below the global value. 3. Scope override does not affect unscoped packages. 4. Override on a different scope does not leak into the queried scope. 5. Scope override tightens the gate even when the global is disabled (`0`). 6. `--no-time-gate` bypasses scope override. All existing tests in the gate suite continue to pass. ## Checklist - [x] I have read the [Contributing Guide](https://yarnpkg.com/advanced/contributing). - [x] I have set the packages that need to be released for my changes to be effective (`@yarnpkg/plugin-npm` minor, `@yarnpkg/plugin-essentials` patch; `.yarn/versions/9a3c1be4.yml`). - [x] I will check that all automated PR checks pass before the PR gets reviewed. | 3 个月前 | |
Adds READMEs (#686) * Adds READMEs * Versions * Fixes infra * Fixes the version tests * Fixes the patch header * Adds a note about the TS logic * Releases the core * Fixes the constraints tests * Don't forget to build plugins for integration tests | 6 年前 | |
Sync master with the changes from master | 1 个月前 |
| 文件 | 最后提交记录 | 最后更新时间 |
|---|---|---|
| 3 个月前 | ||
| 6 年前 | ||
| 1 个月前 |