Skip to content
This repository was archived by the owner on Aug 6, 2026. It is now read-only.

chore: require 7-day package release age #2127

Merged
annikaschmid merged 3 commits into from
May 13, 2026
Merged

chore: require 7-day package release age #2127

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
12f6fb9
chore: require 7-day package release age
annikaschmid May 13, 2026
17f9f29
fix: remove npm release age override
annikaschmid May 13, 2026
4762c61
fix: require pnpm installs
annikaschmid May 13, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,7 @@
},
"packageManager": "pnpm@10.23.0+sha512.21c4e5698002ade97e4efe8b8b4a89a8de3c85a37919f957e7a0f30f38fbc5bbdd05980ffe29179b2fb6e6e691242e098d945d1601772cad0fef5fb6411e2a4b",
"scripts": {
"preinstall": "node scripts/enforce-pnpm.mjs",
"setup": "bash apps/code/bin/setup",
"prepare": "husky",
"dev": "pnpm build:deps && bash scripts/ensure-phrocs.sh && bin/phrocs --config mprocs.yaml",
Expand Down
2 changes: 1 addition & 1 deletion pnpm-workspace.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@ ignoredBuiltDependencies:
- msw
- protobufjs

minimumReleaseAge: 1440
minimumReleaseAge: 10080

@greptile-apps greptile-apps Bot May 13, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 npm guardrail missing from .npmrc

The PR description states "add a matching npm minimum release age guardrail," but .npmrc only contains node-linker=hoisted and shamefully-hoist=true — no minimumReleaseAge entry was added. Any install performed with plain npm (e.g. some CI steps or contributors not using pnpm) will not be subject to the 7-day age gate, leaving the guardrail incomplete for those paths.

Prompt To Fix With AI 
This is a comment left during a code review.
Path: pnpm-workspace.yaml
Line: 9

Comment:
**npm guardrail missing from `.npmrc`**

The PR description states "add a matching npm minimum release age guardrail," but `.npmrc` only contains `node-linker=hoisted` and `shamefully-hoist=true` — no `minimumReleaseAge` entry was added. Any install performed with plain `npm` (e.g. some CI steps or contributors not using pnpm) will not be subject to the 7-day age gate, leaving the guardrail incomplete for those paths.

How can I resolve this? If you propose a fix, please make it concise.

@annikaschmid annikaschmid May 13, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Added a preinstall guard in package.json that fails plain npm install and requires pnpm install instead. That closes the npm bypass path without reintroducing an npm minimumReleaseAge setting that cannot honor minimumReleaseAgeExclude.


minimumReleaseAgeExclude:
- '@agentclientprotocol/sdk'
Expand Down
14 changes: 14 additions & 0 deletions scripts/enforce-pnpm.mjs
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,14 @@
const userAgent = process.env.npm_config_user_agent ?? "";

if (userAgent.startsWith("pnpm/")) {
process.exit(0);
}

console.error(
[
"This repository must be installed with pnpm.",
"Use `pnpm install` so the workspace minimumReleaseAge policy and exclusions are applied consistently.",
].join("\n"),
);

process.exit(1);
Loading