Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

ci(custom-checks): fix depcheck not detecting missing dependencies #3346

Merged

Conversation

petermetz
Copy link
Contributor

  1. The depcheck tool we use have not correctly discovered some of the
    missing dependencies that we have because it only verifies that the
    imported dependency is present SOMEwhere in the package.json file, not that
    it is specifically present in the production dependencies section which
    leads to crashes and broken packages due to the API server not installing
    dev dependencies when instantiating a plugin and therefore missing a few
    of the dependencies that are otherwise very much needed at runtime in
    production.
  2. The solution to the problem was to implement our own typescript parsing
    with babel and then double check the work of depcheck to make sure that
    the dependencies that it marks as "no issues" are actually OK and have no
    issues.
  3. The hardest edge case was type imports e.g. import type { Express } from "express";
    because the import was there, but we did not actually need that dependency
    in the production dependencies as long as ALL of the imports to it in the
    given package were type imports. To robustly verify this being the case or not
    we had to pull out the big guns and parse all the typescript code per package
    to make sure that we've looked at every single import of the dependency in
    question at every single code file of the package in question.

Depends on #3345

Signed-off-by: Peter Somogyvari peter.somogyvari@accenture.com

Pull Request Requirements

  • Rebased onto upstream/main branch and squashed into single commit to help maintainers review it more efficient and to avoid spaghetti git commit graphs that obfuscate which commit did exactly what change, when and, why.
  • Have git sign off at the end of commit message to avoid being marked red. You can add -s flag when using git commit command. You may refer to this link for more information.
  • Follow the Commit Linting specification. You may refer to this link for more information.

Character Limit

  • Pull Request Title and Commit Subject must not exceed 72 characters (including spaces and special characters).
  • Commit Message per line must not exceed 80 characters (including spaces and special characters).

A Must Read for Beginners
For rebasing and squashing, here's a must read guide for beginners.

Copy link

This PR/issue depends on:

@petermetz petermetz force-pushed the ci-fix-check-missing-node-deps branch from c334745 to e3b6d75 Compare June 25, 2024 03:25
Copy link
Contributor

@jagpreetsinghsasan jagpreetsinghsasan left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

1. The depcheck tool we use have not correctly discovered some of the
missing dependencies that we have because it only verifies that the
imported dependency is present SOMEwhere in the package.json file, not that
it is specifically present in the production dependencies section which
leads to crashes and broken packages due to the API server not installing
dev dependencies when instantiating a plugin and therefore missing a few
of the dependencies that are otherwise very much needed at runtime in
production.
2. The solution to the problem was to implement our own typescript parsing
with babel and then double check the work of depcheck to make sure that
the dependencies that it marks as "no issues" are actually OK and have no
issues.
3. The hardest edge case was type imports e.g. `import type { Express } from "express";`
because the import was there, but we did not actually need that dependency
in the production dependencies as long as ALL of the imports to it in the
given package were type imports. To robustly verify this being the case or not
we had to pull out the big guns and parse all the typescript code per package
to make sure that we've looked at every single import of the dependency in
question at every single code file of the package in question.

Depends on hyperledger-cacti#3345

Signed-off-by: Peter Somogyvari <peter.somogyvari@accenture.com>
@petermetz petermetz force-pushed the ci-fix-check-missing-node-deps branch from e3b6d75 to 774ded4 Compare June 27, 2024 15:33
@petermetz petermetz disabled auto-merge June 27, 2024 15:47
@petermetz petermetz merged commit 5abbbff into hyperledger-cacti:main Jun 27, 2024
149 of 150 checks passed
@petermetz petermetz deleted the ci-fix-check-missing-node-deps branch June 27, 2024 16:50
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants