Merge Upstream - #7
Conversation
[CI] - Setup wallet initialisation CRON job for monitoring wallet setup scripts
ghost
self-assigned this
WalkthroughThe pull request updates package metadata and pnpm configuration, standardises existing GitHub Actions workflows on Node.js 24 and pnpm 11, and adds scheduled wallet initialisation for the canonical repository. ChangesCI and package release updates
Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/chainwright.yaml:
- Around line 72-73: Update the “Install dependencies” workflow step to run pnpm
install with --frozen-lockfile instead of --no-frozen-lockfile, ensuring CI uses
the committed pnpm-lock.yaml without modifying it.
In @.github/workflows/schedule-wallet-initialization-runs.yaml:
- Around line 23-27: Update the actions/checkout step to set persist-credentials
to false alongside the existing submodules and fetch-depth options, preventing
the GITHUB_TOKEN from being stored in local Git configuration.
- Around line 37-38: Update the Install dependencies step in the workflow to run
pnpm install with --frozen-lockfile instead of --no-frozen-lockfile, ensuring
dependency installation fails when package.json and pnpm-lock.yaml diverge.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: ca0fd721-b747-4e23-b71f-8dbe9392faef
⛔ Files ignored due to path filters (1)
pnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (9)
.github/workflows/chainwright.yaml.github/workflows/linting-and-unit-tests.yaml.github/workflows/release.yml.github/workflows/schedule-wallet-initialization-runs.yaml.gitignoreCHANGELOG.mdLICENSEpackage.jsonpnpm-workspace.yaml
💤 Files with no reviewable changes (1)
- .gitignore
| - name: Install dependencies | ||
| run: pnpm install | ||
| run: pnpm install --no-frozen-lockfile |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -eu
printf '%s\n' '--- workflow ---'
cat -n .github/workflows/chainwright.yaml | sed -n '55,85p'
printf '%s\n' '--- package-manager files ---'
git ls-files | rg '(^|/)(package.json|pnpm-lock.yaml|pnpm-workspace.yaml|\.npmrc|packageManager)$|(^|/)package\.json$' || true
printf '%s\n' '--- package.json metadata ---'
if [ -f package.json ]; then
sed -n '1,100p' package.json
fi
printf '%s\n' '--- pnpm-related configuration ---'
for f in .npmrc pnpm-workspace.yaml; do
if [ -f "$f" ]; then
printf '%s\n' "--- $f ---"
cat -n "$f"
fi
done
printf '%s\n' '--- workflow install commands ---'
rg -n -C 3 'pnpm install|frozen-lockfile|no-frozen-lockfile|corepack|pnpm/action-setup|setup-node' .github package.json pnpm-workspace.yaml .npmrc 2>/dev/null || trueRepository: TruFin-io/chainwright
Length of output: 6862
🏁 Script executed:
#!/bin/bash
set -eu
python3 - <<'PY'
from pathlib import Path
import json, re
workflow = Path(".github/workflows/chainwright.yaml").read_text()
lockfile = Path("pnpm-lock.yaml")
print("target_command:", next((line.strip() for line in workflow.splitlines()
if "pnpm install" in line), "<missing>"))
print("has_frozen_lockfile:", "--frozen-lockfile" in workflow)
print("has_no_frozen_lockfile:", "--no-frozen-lockfile" in workflow)
print("tracked_lockfile_exists:", lockfile.exists())
print("lockfile_bytes:", lockfile.stat().st_size if lockfile.exists() else 0)
# Read only the importer keys from pnpm-lock.yaml. This avoids requiring a YAML
# package and is sufficient to establish whether the root package importer is
# present in the tracked lockfile.
if lockfile.exists():
text = lockfile.read_text()
importers = []
in_importers = False
for line in text.splitlines():
if line == "importers:":
in_importers = True
continue
if in_importers:
if line and not line.startswith(" ") and not line.startswith("#"):
break
match = re.match(r"^ ([^:#][^:]*):\s*$", line)
if match:
importers.append(match.group(1))
print("lockfile_importers:", importers)
manifests = []
for path in sorted(Path(".").rglob("package.json")):
if any(part in {".git", "node_modules", "dist", "build"} for part in path.parts):
continue
data = json.loads(path.read_text())
manifests.append((str(path), data.get("name"), bool(data.get("dependencies") or data.get("devDependencies") or data.get("peerDependencies"))))
print("package_manifests:", manifests)
PY
if command -v pnpm >/dev/null 2>&1; then
printf 'pnpm_version: '
pnpm --version
else
echo 'pnpm_version: <not available>'
fiRepository: TruFin-io/chainwright
Length of output: 952
🌐 Web query:
pnpm install --frozen-lockfile --no-frozen-lockfile CI default lockfile documentation
💡 Result:
In pnpm, the --frozen-lockfile flag controls whether the installation process permits modifications to the pnpm-lock.yaml file [1][2][3]. When enabled, pnpm will not generate or update the lockfile and will fail the installation if the existing lockfile is out of sync with the project's manifest (e.g., package.json) or if no lockfile is present [1][2][4]. Default CI Behavior pnpm automatically detects if it is running in a continuous integration (CI) environment [5][6]. When CI is detected, --frozen-lockfile is enabled by default [1][4]. This ensures that builds are reproducible and that the project is not relying on uncommitted changes to dependencies [7]. --no-frozen-lockfile The --no-frozen-lockfile flag explicitly disables the frozen lockfile requirement [3]. This is useful in CI environments if you need to override the default behavior to allow pnpm to update or generate a lockfile during the installation process [8][3]. Summary of Key Points --frozen-lockfile: Fails if the lockfile needs an update or is missing [1][2]. Default in CI [1][5]. --no-frozen-lockfile: Explicitly allows pnpm to update or create a lockfile, even in CI [3]. CI Detection: pnpm identifies CI environments using common environment variables such as CI, CONTINUOUS_INTEGRATION, BUILD_NUMBER, and others [1][4]. It is important to note that --frozen-lockfile does not perform updates to your packages; it strictly enforces that the current dependency tree matches the existing lockfile [7]. To update dependencies, you should use commands like pnpm update [7]. [1][2][7][3][5][4][6]
Citations:
- 1: https://pnpm.io/10.x/cli/install
- 2: https://pnpm.io/cli/install
- 3: https://github.com/pnpm/pnpm/blob/e1e29c15/installing/commands/src/install.ts
- 4: https://pnpm.io/next/cli/install
- 5: https://pnpm.io/continuous-integration
- 6: https://pnpm.io/next/continuous-integration
- 7: pnpm install --frozen-lockfile=false will not update the outdated packages pnpm/pnpm#7740
- 8: Unexpected interaction between --lockfile-only with --frozen-lockfile modifies the lockfile. pnpm/pnpm#6962
Use --frozen-lockfile in CI. --no-frozen-lockfile permits updates to pnpm-lock.yaml, so CI can test an uncommitted dependency graph. Commit lockfile changes with dependency updates.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/chainwright.yaml around lines 72 - 73, Update the “Install
dependencies” workflow step to run pnpm install with --frozen-lockfile instead
of --no-frozen-lockfile, ensuring CI uses the committed pnpm-lock.yaml without
modifying it.
| - name: Checkout code | ||
| uses: actions/checkout@v5 | ||
| with: | ||
| submodules: "recursive" | ||
| fetch-depth: 0 |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -eu
file=".github/workflows/schedule-wallet-initialization-runs.yaml"
printf '%s\n' '--- workflow excerpt ---'
cat -n "$file" | sed -n '1,180p'
printf '%s\n' '--- checkout credential settings in workflows ---'
rg -n -C 3 'actions/checkout@|persist-credentials|pnpm install|setup-wallets' .github/workflowsRepository: TruFin-io/chainwright
Length of output: 6983
🌐 Web query:
actions/checkout v5 README persist-credentials default local Git configuration
💡 Result:
In the actions/checkout v5 action, the persist-credentials input defaults to true [1][2]. When set to true (the default), the action automatically configures the local Git configuration with the authentication token or SSH key used to check out the repository [1][3]. This persistence enables subsequent steps in your workflow to execute authenticated Git commands without requiring additional configuration [1]. The action includes a post-job cleanup step that removes this token from the local Git configuration once the job is complete [1][4]. To disable this behavior and prevent the token or key from being added to the local Git configuration, you can explicitly set persist-credentials to false in your workflow file [1][5].
Citations:
- 1: https://github.com/actions/checkout/?tab=readme-ov-file
- 2: https://github.com/actions/checkout/blob/72f2cec99f417b1a1c5e2e88945068983b7965f9/action.yml
- 3: https://git.woni.link/actions/checkout/src/branch/releases/v5/action.yml
- 4: https://gitea.s1f.ren/actions/checkout/raw/tag/v5.0.1/README.md
- 5: https://git.liteyuki.org/actions/checkout/src/tag/v5/README.md
Disable checkout credential persistence.
actions/checkout@v5 stores GITHUB_TOKEN in the local Git configuration by default. Later dependency and repository scripts can access it. Set persist-credentials: false.
🧰 Tools
🪛 zizmor (1.29.0)
[warning] 23-27: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/schedule-wallet-initialization-runs.yaml around lines 23 -
27, Update the actions/checkout step to set persist-credentials to false
alongside the existing submodules and fetch-depth options, preventing the
GITHUB_TOKEN from being stored in local Git configuration.
Sources: MCP tools, Linters/SAST tools
| - name: Install dependencies | ||
| run: pnpm install --no-frozen-lockfile |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -eu
printf '%s\n' '--- workflow ---'
cat -n .github/workflows/schedule-wallet-initialization-runs.yaml
printf '%s\n' '--- dependency manifests and lockfiles ---'
git ls-files | grep -E '(^|/)(package\.json|pnpm-lock\.yaml|pnpm-workspace\.yaml)$' || true
printf '%s\n' '--- package-manager metadata ---'
for f in package.json pnpm-workspace.yaml; do
if [ -f "$f" ]; then
echo "[$f]"
cat -n "$f"
fi
done
printf '%s\n' '--- lockfile header ---'
if [ -f pnpm-lock.yaml ]; then
sed -n '1,35p' pnpm-lock.yaml
fiRepository: TruFin-io/chainwright
Length of output: 6980
🏁 Script executed:
#!/bin/bash
set -eu
python3 - <<'PY'
import json
from pathlib import Path
package = json.loads(Path("package.json").read_text())
lock = Path("pnpm-lock.yaml").read_text()
print("--- manifest and lockfile importer coverage ---")
for section in ("dependencies", "devDependencies", "peerDependencies"):
names = package.get(section, {})
print(f"{section}: {len(names)} entries")
for name, spec in names.items():
marker = f" {name}:"
print(f" {name}: manifest={spec!r}, importer_present={marker in lock}")
print("--- relevant workflow steps after installation ---")
lines = Path(".github/workflows/schedule-wallet-initialization-runs.yaml").read_text().splitlines()
for number, line in enumerate(lines, 1):
if number >= 37:
print(f"{number}: {line}")
PYRepository: TruFin-io/chainwright
Length of output: 1720
🌐 Web query:
pnpm install --no-frozen-lockfile --frozen-lockfile CI documentation lockfile update behaviour
💡 Result:
In pnpm, --frozen-lockfile and --no-frozen-lockfile control whether the lockfile (pnpm-lock.yaml) is permitted to be modified during an installation [1][2]. --frozen-lockfile When enabled, pnpm will not generate or update the lockfile [1][2]. If the lockfile is missing or out of sync with the manifest (e.g., package.json), the installation will fail [1][2]. This is the default behavior in CI environments [1][3]. --no-frozen-lockfile When enabled, this explicitly disables the "frozen" requirement, allowing pnpm to update the lockfile if it is out of sync with the manifest [1][2]. CI Environment Behavior pnpm automatically detects CI environments and defaults to --frozen-lockfile [1][3]. This is intended to ensure that builds are reproducible and that the lockfile is not silently changed during the CI process [4][3]. If an update is required, the CI build will fail rather than overwriting the lockfile [1][3]. Important Considerations 1. No Automatic Updates: Neither --frozen-lockfile nor --no-frozen-lockfile are commands for updating dependencies [4]. To update dependencies, you must use commands like pnpm update [4]. 2. CI Inconsistencies: While --frozen-lockfile is default in CI, some users have reported discrepancies in how pnpm handles broken or malformed lockfiles depending on whether --frozen-lockfile is passed explicitly or triggered automatically by CI environment detection [5]. Explicitly passing --frozen-lockfile is generally the safest way to ensure strict enforcement [6][5]. 3. Version Compatibility: Since pnpm v11, pnpm will fail in CI if it encounters a lockfile generated by a newer major version of pnpm, preventing silent/incompatible rewrites [3][7]. In summary, use --frozen-lockfile in your CI pipelines to prevent accidental lockfile modifications and ensure build reproducibility [4][3]. If you have a specific, validated reason to allow changes to the lockfile during a CI process (which is generally discouraged), you can override this with --no-frozen-lockfile [1][2].
Citations:
- 1: https://pnpm.io/10.x/cli/install
- 2: https://github.com/pnpm/pnpm/blob/e1e29c15/installing/commands/src/install.ts
- 3: https://pnpm.io/continuous-integration
- 4: pnpm install --frozen-lockfile=false will not update the outdated packages pnpm/pnpm#7740
- 5:
--frozen-lockfileand CI Install Behavior Inconsistent with Broken Lockfile pnpm/pnpm#9995 - 6: v9 install command upgrades Lockfile in CI environment pnpm/pnpm#8099
- 7: https://pnpm.io/next/continuous-integration
🏁 Script executed:
#!/bin/bash
set -eu
python3 - <<'PY'
import json
import re
from pathlib import Path
package = json.loads(Path("package.json").read_text())
lines = Path("pnpm-lock.yaml").read_text().splitlines()
start = next(i for i, line in enumerate(lines) if line == " .:")
end = next(
(i for i in range(start + 1, len(lines)) if lines[i] and not lines[i].startswith(" ")),
len(lines),
)
importer = lines[start:end]
print("--- lockfile metadata ---")
print(next(line for line in lines if line.startswith("lockfileVersion:")))
print("--- root importer dependency keys ---")
keys = []
for line in importer:
match = re.match(r"^ ('[^']+'|[^:]+):$", line)
if match:
keys.append(match.group(1).strip("'"))
print("\n".join(keys))
print("--- manifest entries absent from root importer ---")
for section in ("dependencies", "devDependencies", "peerDependencies"):
for name in package.get(section, {}):
if name not in keys:
print(f"{section}: {name}")
print("--- root importer entries absent from manifest sections ---")
manifest_names = {
name
for section in ("dependencies", "devDependencies", "peerDependencies")
for name in package.get(section, {})
}
for name in keys:
if name not in manifest_names and name not in {"dependencies", "devDependencies", "peerDependencies"}:
print(name)
PYRepository: TruFin-io/chainwright
Length of output: 544
🌐 Web query:
site:pnpm.io/cli/install --no-frozen-lockfile frozen lockfile CI
💡 Result:
The --frozen-lockfile flag is used in package managers like pnpm to ensure that the installed dependencies exactly match the versions specified in the lockfile [1]. When --frozen-lockfile is enabled, the package manager will not update the lockfile and will fail the installation process if the lockfile is out of sync with the project manifest (package.json) or if the lockfile is missing [1]. In CI (Continuous Integration) environments, this flag is typically enabled by default to ensure reproducible builds by preventing unintended updates to dependencies [1]. Conversely, --no-frozen-lockfile explicitly instructs the package manager to allow the modification or generation of the lockfile during the installation process, even if it deviates from the current state [1]. Using this flag in a CI environment can be risky because it may lead to inconsistencies between the environment where the code was developed and the environment where it is built [1]. While specific implementation details vary by tool, the core purpose remains consistent across package managers: - --frozen-lockfile: Ensures stability and reproducibility by enforcing strict adherence to the existing lockfile [1]. - --no-frozen-lockfile: Prioritizes flexibility by allowing the package manager to update the lockfile if it detects discrepancies [1]. In most CI pipelines, it is best practice to rely on the default behavior (or explicitly set --frozen-lockfile) to guarantee that every build uses the exact same dependency tree [1].
Citations:
Keep dependency installation locked.
Use pnpm install --frozen-lockfile so the job fails when package.json and pnpm-lock.yaml diverge.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/schedule-wallet-initialization-runs.yaml around lines 37 -
38, Update the Install dependencies step in the workflow to run pnpm install
with --frozen-lockfile instead of --no-frozen-lockfile, ensuring dependency
installation fails when package.json and pnpm-lock.yaml diverge.
Source: MCP tools
1 participant
Upgrades project dependencies and releases version
0.10.15.Updates GitHub Actions to use Node.js 24 and pnpm 11, with consistent permissions, repository checks, caching, and dependency installation. Adds scheduled and manual wallet initialisation monitoring with Chromium and XVFB support.
Adds workspace configuration, updates
tsxandtar, and corrects the MIT licence copyright holder.