| 文件 | 最后提交记录 | 最后更新时间 |
|---|---|---|
feat(plugin-npm): allow npmMinimalAgeGate per npmScope (#7156) ## What's the problem this PR addresses? Closes #6984. `npmMinimalAgeGate` is currently a single global setting. In environments that mix a public registry (where the gate is desired for supply-chain protection) with one or more trusted private/internal registries (where freshly published packages must be installable immediately), there is no way to express different policies per scope. Disabling the gate globally is the only workaround, which removes the protection everywhere. ## How did you fix it? Allow `npmMinimalAgeGate` inside an `npmScopes` entry, falling back to the global value when unset: ```yaml npmMinimalAgeGate: 1d npmScopes: my-corp: npmRegistryServer: https://npm.pkg.mycompany.com npmMinimalAgeGate: 0 ``` Implementation: - Added `npmMinimalAgeGate` to the `npmScopes` shape (and to `ConfigurationValueMap`) in `packages/plugin-npm/sources/index.ts`. `npmPreapprovedPackages` stays global only. - Introduced `getMinimalAgeGate(ident, {configuration})` in `packages/plugin-npm/sources/npmConfigUtils.ts`. Resolution rule: 1. If the ident has a scope and that scope sets `npmMinimalAgeGate` -> return the scope value. 2. Else -> return the global value. There is no longer any global-specific short-circuit: the scope value always wins when present, including the case where the global is `0` but a scope tightens the gate. - `shouldBeQuarantined` now consults the helper instead of reading the global directly. No public API or call-site signature changes (`ident` was already on `IsPackageApprovedOptions`). - The JSR default scope object does not declare `npmMinimalAgeGate`, so JSR-scoped lookups fall through to the global; no regression. ### \`--no-time-gate\` Previously the CLI flag relied on the \`global === 0\` short-circuit to disable the gate everywhere. With that short-circuit gone, setting the global to \`0\` alone is no longer enough, since each scope carries its own gate (explicit, or the inherited default). The flag now goes through a shared \`suggestUtils.disableTimeGate(configuration)\` helper (used by \`add\` and \`up\`) that: 1. Sets the global \`npmMinimalAgeGate\` to \`0\` via a \`<cli>\` override. 2. Strips \`npmMinimalAgeGate\` from every \`npmScopes\` entry, so the CLI override is the only remaining source of truth. (\`npmMinimalAgeGate\` is not registry-scopable -- it lives on the global config and on \`npmScopes\` only -- so nothing needs to be stripped from \`npmRegistries\`.) Tests (`packages/acceptance-tests/pkg-tests-specs/sources/features/npmMinimalAgeGate.test.ts`) add a new `describe('npmScopes override')` block: 1. Scope override tightens the gate beyond the global value. 2. Scope override loosens the gate below the global value. 3. Scope override does not affect unscoped packages. 4. Override on a different scope does not leak into the queried scope. 5. Scope override tightens the gate even when the global is disabled (`0`). 6. `--no-time-gate` bypasses scope override. All existing tests in the gate suite continue to pass. ## Checklist - [x] I have read the [Contributing Guide](https://yarnpkg.com/advanced/contributing). - [x] I have set the packages that need to be released for my changes to be effective (`@yarnpkg/plugin-npm` minor, `@yarnpkg/plugin-essentials` patch; `.yarn/versions/9a3c1be4.yml`). - [x] I will check that all automated PR checks pass before the PR gets reviewed. | 4 个月前 | |
fix: handle unintentional floating promises (#4947) | 3 年前 | |
feat: when initializing the `Configuration`, auto fetch the missing plugins (#4912) * feat(core): load the rcfile completely before loading third-party plugins * feat(core): when initializing the `Configuration`, check if the plugin exists and try to fetch the missing plugins * refactor: convert `plugins.test` from js to ts * test: test `yarn install` fetch missing plugins * feat(essentials): record plugin checksum to RC file * refactor: added a new method to `Configuration` - `addPlugin` * feat(core): when fetching missing plugins, it will also update the RC File * test: when adding a plugin, the RC file should have the plugin checksum * fix(core): fix the problem of third-party definitions not loading * feat(core): throw an error if a different checksum is found when refetching the plugin * feat(essentials): new command option for `plugin import` - `--checksum` * feat(essentials): new plugin command - `plugin check` * test: delete duplicate test * test: refactor plugin utility position * test: make sure the plugin definition can be loaded * test: it should throw an error when fetching the plugin but the checksum does not match * test: test for whether "Plugin Import" should update the checksum * test: test `plugin check` function * Small tweaks * Fixes lint * test: refactor the `mockPluginServer` utility function * Update plugins.utility.ts * Update plugins.utility.ts Co-authored-by: Maël Nison <nison.mael@gmail.com> | 3 年前 | |
feat(plugin-npm): allow npmMinimalAgeGate per npmScope (#7156) ## What's the problem this PR addresses? Closes #6984. `npmMinimalAgeGate` is currently a single global setting. In environments that mix a public registry (where the gate is desired for supply-chain protection) with one or more trusted private/internal registries (where freshly published packages must be installable immediately), there is no way to express different policies per scope. Disabling the gate globally is the only workaround, which removes the protection everywhere. ## How did you fix it? Allow `npmMinimalAgeGate` inside an `npmScopes` entry, falling back to the global value when unset: ```yaml npmMinimalAgeGate: 1d npmScopes: my-corp: npmRegistryServer: https://npm.pkg.mycompany.com npmMinimalAgeGate: 0 ``` Implementation: - Added `npmMinimalAgeGate` to the `npmScopes` shape (and to `ConfigurationValueMap`) in `packages/plugin-npm/sources/index.ts`. `npmPreapprovedPackages` stays global only. - Introduced `getMinimalAgeGate(ident, {configuration})` in `packages/plugin-npm/sources/npmConfigUtils.ts`. Resolution rule: 1. If the ident has a scope and that scope sets `npmMinimalAgeGate` -> return the scope value. 2. Else -> return the global value. There is no longer any global-specific short-circuit: the scope value always wins when present, including the case where the global is `0` but a scope tightens the gate. - `shouldBeQuarantined` now consults the helper instead of reading the global directly. No public API or call-site signature changes (`ident` was already on `IsPackageApprovedOptions`). - The JSR default scope object does not declare `npmMinimalAgeGate`, so JSR-scoped lookups fall through to the global; no regression. ### \`--no-time-gate\` Previously the CLI flag relied on the \`global === 0\` short-circuit to disable the gate everywhere. With that short-circuit gone, setting the global to \`0\` alone is no longer enough, since each scope carries its own gate (explicit, or the inherited default). The flag now goes through a shared \`suggestUtils.disableTimeGate(configuration)\` helper (used by \`add\` and \`up\`) that: 1. Sets the global \`npmMinimalAgeGate\` to \`0\` via a \`<cli>\` override. 2. Strips \`npmMinimalAgeGate\` from every \`npmScopes\` entry, so the CLI override is the only remaining source of truth. (\`npmMinimalAgeGate\` is not registry-scopable -- it lives on the global config and on \`npmScopes\` only -- so nothing needs to be stripped from \`npmRegistries\`.) Tests (`packages/acceptance-tests/pkg-tests-specs/sources/features/npmMinimalAgeGate.test.ts`) add a new `describe('npmScopes override')` block: 1. Scope override tightens the gate beyond the global value. 2. Scope override loosens the gate below the global value. 3. Scope override does not affect unscoped packages. 4. Override on a different scope does not leak into the queried scope. 5. Scope override tightens the gate even when the global is disabled (`0`). 6. `--no-time-gate` bypasses scope override. All existing tests in the gate suite continue to pass. ## Checklist - [x] I have read the [Contributing Guide](https://yarnpkg.com/advanced/contributing). - [x] I have set the packages that need to be released for my changes to be effective (`@yarnpkg/plugin-npm` minor, `@yarnpkg/plugin-essentials` patch; `.yarn/versions/9a3c1be4.yml`). - [x] I will check that all automated PR checks pass before the PR gets reviewed. | 4 个月前 |
| 文件 | 最后提交记录 | 最后更新时间 |
|---|---|---|
| 4 个月前 | ||
| 3 年前 | ||
| 3 年前 | ||
| 4 个月前 |