Merge Upstream #7
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,47 @@ | ||
| name: Scheduled Wallet Initialization Runs | ||
|
|
||
| on: | ||
| workflow_dispatch: | ||
|
|
||
| schedule: | ||
| # Runs at 6 AM UTC, Monday - Friday | ||
| - cron: "0 6 * * 1-5" | ||
|
|
||
| permissions: | ||
| contents: read | ||
|
|
||
| jobs: | ||
| setup-wallets: | ||
| if: github.repository == 'amaify/chainwright' | ||
| runs-on: ubuntu-22.04 | ||
| timeout-minutes: 60 | ||
| strategy: | ||
| matrix: | ||
| node-version: [24] | ||
|
|
||
| steps: | ||
| - name: Checkout code | ||
| uses: actions/checkout@v5 | ||
| with: | ||
| submodules: "recursive" | ||
| fetch-depth: 0 | ||
|
Comment on lines
+23
to
+27
There was a problem hiding this comment. 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -eu
file=".github/workflows/schedule-wallet-initialization-runs.yaml"
printf '%s\n' '--- workflow excerpt ---'
cat -n "$file" | sed -n '1,180p'
printf '%s\n' '--- checkout credential settings in workflows ---'
rg -n -C 3 'actions/checkout@|persist-credentials|pnpm install|setup-wallets' .github/workflowsRepository: TruFin-io/chainwright Length of output: 6983 🌐 Web query:
💡 Result: In the actions/checkout v5 action, the persist-credentials input defaults to true [1][2]. When set to true (the default), the action automatically configures the local Git configuration with the authentication token or SSH key used to check out the repository [1][3]. This persistence enables subsequent steps in your workflow to execute authenticated Git commands without requiring additional configuration [1]. The action includes a post-job cleanup step that removes this token from the local Git configuration once the job is complete [1][4]. To disable this behavior and prevent the token or key from being added to the local Git configuration, you can explicitly set persist-credentials to false in your workflow file [1][5]. Citations:
Disable checkout credential persistence.
🧰 Tools🪛 zizmor (1.29.0)[warning] 23-27: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false (artipacked) 🤖 Prompt for AI AgentsSources: MCP tools, Linters/SAST tools |
||
|
|
||
| - name: Install pnpm | ||
| uses: pnpm/setup@v2 | ||
| with: | ||
| runtime: node@${{ matrix.node-version }} | ||
| version: 11 | ||
| install: false | ||
| cache: true | ||
|
|
||
| - name: Install dependencies | ||
| run: pnpm install --no-frozen-lockfile | ||
|
Comment on lines
+37
to
+38
There was a problem hiding this comment. 🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -eu
printf '%s\n' '--- workflow ---'
cat -n .github/workflows/schedule-wallet-initialization-runs.yaml
printf '%s\n' '--- dependency manifests and lockfiles ---'
git ls-files | grep -E '(^|/)(package\.json|pnpm-lock\.yaml|pnpm-workspace\.yaml)$' || true
printf '%s\n' '--- package-manager metadata ---'
for f in package.json pnpm-workspace.yaml; do
if [ -f "$f" ]; then
echo "[$f]"
cat -n "$f"
fi
done
printf '%s\n' '--- lockfile header ---'
if [ -f pnpm-lock.yaml ]; then
sed -n '1,35p' pnpm-lock.yaml
fiRepository: TruFin-io/chainwright Length of output: 6980 🏁 Script executed: #!/bin/bash
set -eu
python3 - <<'PY'
import json
from pathlib import Path
package = json.loads(Path("package.json").read_text())
lock = Path("pnpm-lock.yaml").read_text()
print("--- manifest and lockfile importer coverage ---")
for section in ("dependencies", "devDependencies", "peerDependencies"):
names = package.get(section, {})
print(f"{section}: {len(names)} entries")
for name, spec in names.items():
marker = f" {name}:"
print(f" {name}: manifest={spec!r}, importer_present={marker in lock}")
print("--- relevant workflow steps after installation ---")
lines = Path(".github/workflows/schedule-wallet-initialization-runs.yaml").read_text().splitlines()
for number, line in enumerate(lines, 1):
if number >= 37:
print(f"{number}: {line}")
PYRepository: TruFin-io/chainwright Length of output: 1720 🌐 Web query:
💡 Result: In pnpm, --frozen-lockfile and --no-frozen-lockfile control whether the lockfile (pnpm-lock.yaml) is permitted to be modified during an installation [1][2]. --frozen-lockfile When enabled, pnpm will not generate or update the lockfile [1][2]. If the lockfile is missing or out of sync with the manifest (e.g., package.json), the installation will fail [1][2]. This is the default behavior in CI environments [1][3]. --no-frozen-lockfile When enabled, this explicitly disables the "frozen" requirement, allowing pnpm to update the lockfile if it is out of sync with the manifest [1][2]. CI Environment Behavior pnpm automatically detects CI environments and defaults to --frozen-lockfile [1][3]. This is intended to ensure that builds are reproducible and that the lockfile is not silently changed during the CI process [4][3]. If an update is required, the CI build will fail rather than overwriting the lockfile [1][3]. Important Considerations 1. No Automatic Updates: Neither --frozen-lockfile nor --no-frozen-lockfile are commands for updating dependencies [4]. To update dependencies, you must use commands like pnpm update [4]. 2. CI Inconsistencies: While --frozen-lockfile is default in CI, some users have reported discrepancies in how pnpm handles broken or malformed lockfiles depending on whether --frozen-lockfile is passed explicitly or triggered automatically by CI environment detection [5]. Explicitly passing --frozen-lockfile is generally the safest way to ensure strict enforcement [6][5]. 3. Version Compatibility: Since pnpm v11, pnpm will fail in CI if it encounters a lockfile generated by a newer major version of pnpm, preventing silent/incompatible rewrites [3][7]. In summary, use --frozen-lockfile in your CI pipelines to prevent accidental lockfile modifications and ensure build reproducibility [4][3]. If you have a specific, validated reason to allow changes to the lockfile during a CI process (which is generally discouraged), you can override this with --no-frozen-lockfile [1][2]. Citations:
🏁 Script executed: #!/bin/bash
set -eu
python3 - <<'PY'
import json
import re
from pathlib import Path
package = json.loads(Path("package.json").read_text())
lines = Path("pnpm-lock.yaml").read_text().splitlines()
start = next(i for i, line in enumerate(lines) if line == " .:")
end = next(
(i for i in range(start + 1, len(lines)) if lines[i] and not lines[i].startswith(" ")),
len(lines),
)
importer = lines[start:end]
print("--- lockfile metadata ---")
print(next(line for line in lines if line.startswith("lockfileVersion:")))
print("--- root importer dependency keys ---")
keys = []
for line in importer:
match = re.match(r"^ ('[^']+'|[^:]+):$", line)
if match:
keys.append(match.group(1).strip("'"))
print("\n".join(keys))
print("--- manifest entries absent from root importer ---")
for section in ("dependencies", "devDependencies", "peerDependencies"):
for name in package.get(section, {}):
if name not in keys:
print(f"{section}: {name}")
print("--- root importer entries absent from manifest sections ---")
manifest_names = {
name
for section in ("dependencies", "devDependencies", "peerDependencies")
for name in package.get(section, {})
}
for name in keys:
if name not in manifest_names and name not in {"dependencies", "devDependencies", "peerDependencies"}:
print(name)
PYRepository: TruFin-io/chainwright Length of output: 544 🌐 Web query:
💡 Result: The --frozen-lockfile flag is used in package managers like pnpm to ensure that the installed dependencies exactly match the versions specified in the lockfile [1]. When --frozen-lockfile is enabled, the package manager will not update the lockfile and will fail the installation process if the lockfile is out of sync with the project manifest (package.json) or if the lockfile is missing [1]. In CI (Continuous Integration) environments, this flag is typically enabled by default to ensure reproducible builds by preventing unintended updates to dependencies [1]. Conversely, --no-frozen-lockfile explicitly instructs the package manager to allow the modification or generation of the lockfile during the installation process, even if it deviates from the current state [1]. Using this flag in a CI environment can be risky because it may lead to inconsistencies between the environment where the code was developed and the environment where it is built [1]. While specific implementation details vary by tool, the core purpose remains consistent across package managers: - --frozen-lockfile: Ensures stability and reproducibility by enforcing strict adherence to the existing lockfile [1]. - --no-frozen-lockfile: Prioritizes flexibility by allowing the package manager to update the lockfile if it detects discrepancies [1]. In most CI pipelines, it is best practice to rely on the default behavior (or explicitly set --frozen-lockfile) to guarantee that every build uses the exact same dependency tree [1]. Citations: Keep dependency installation locked. Use 🤖 Prompt for AI AgentsSource: MCP tools |
||
|
|
||
| - name: Install XVFB | ||
| run: sudo apt-get install -y xvfb | ||
|
|
||
| - name: Install Playwright browsers | ||
| run: pnpm exec playwright install chromium | ||
|
|
||
| - name: Initialize wallets | ||
| run: xvfb-run pnpm run setup-wallets | ||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,7 +1,6 @@ | ||
| # dependencies (bun install) | ||
| node_modules | ||
| test-package | ||
|
|
||
| # output | ||
| out | ||
|
|
||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,6 @@ | ||
| allowBuilds: | ||
| esbuild: true | ||
| minimumReleaseAgeExclude: | ||
| - tsx@4.23.9 || 4.23.10 | ||
| overrides: | ||
| tar: ^7.5.21 |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
Repository: TruFin-io/chainwright
Length of output: 6862
🏁 Script executed:
Repository: TruFin-io/chainwright
Length of output: 952
🌐 Web query:
pnpm install --frozen-lockfile --no-frozen-lockfile CI default lockfile documentation💡 Result:
In pnpm, the --frozen-lockfile flag controls whether the installation process permits modifications to the pnpm-lock.yaml file [1][2][3]. When enabled, pnpm will not generate or update the lockfile and will fail the installation if the existing lockfile is out of sync with the project's manifest (e.g., package.json) or if no lockfile is present [1][2][4]. Default CI Behavior pnpm automatically detects if it is running in a continuous integration (CI) environment [5][6]. When CI is detected, --frozen-lockfile is enabled by default [1][4]. This ensures that builds are reproducible and that the project is not relying on uncommitted changes to dependencies [7]. --no-frozen-lockfile The --no-frozen-lockfile flag explicitly disables the frozen lockfile requirement [3]. This is useful in CI environments if you need to override the default behavior to allow pnpm to update or generate a lockfile during the installation process [8][3]. Summary of Key Points --frozen-lockfile: Fails if the lockfile needs an update or is missing [1][2]. Default in CI [1][5]. --no-frozen-lockfile: Explicitly allows pnpm to update or create a lockfile, even in CI [3]. CI Detection: pnpm identifies CI environments using common environment variables such as CI, CONTINUOUS_INTEGRATION, BUILD_NUMBER, and others [1][4]. It is important to note that --frozen-lockfile does not perform updates to your packages; it strictly enforces that the current dependency tree matches the existing lockfile [7]. To update dependencies, you should use commands like pnpm update [7]. [1][2][7][3][5][4][6]
Citations:
Use
--frozen-lockfilein CI.--no-frozen-lockfilepermits updates topnpm-lock.yaml, so CI can test an uncommitted dependency graph. Commit lockfile changes with dependency updates.🤖 Prompt for AI Agents