test(registry): mirror @pnpm.e2e/* tier-1 fixtures by jdx · Pull Request #424 · endevco/aube

jdx · 2026-04-30T21:33:37Z

Summary

Mirrors 24 @pnpm.e2e/* fixture packages (40 tarballs) into the committed Verdaccio storage at test/registry/storage/@pnpm.e2e/ so Tier 1 bats tests run fully offline.

Why the in-tree procedure didn't apply

test/registry/config.yaml documents an proxy: npmjs uplink as the way to add new fixtures. That doesn't work for these — only 3 @pnpm.e2e/* packages are published to npmjs.org (has-postinstall, testing-provenance2, xxx.has-bundled); none of the 24 we need are reachable. The fixtures live in pnpm/registry-mock as sources that get npm publish-ed into Verdaccio at build time.

How

Cloned pnpm/registry-mock.
Booted its prepublish-config.yaml Verdaccio (storage: ./registry/storage-cache).
Filtered to the 24 requested package names (across all available versions in upstream — 40 tarballs total) and npm publish-ed each via a token-bearing NPM_CONFIG_USERCONFIG npmrc.
Copied the resulting @pnpm.e2e/* directories into test/registry/storage/@pnpm.e2e/.

Special case: `with-same-file-in-different-cases`

This fixture ships both Foo.js and foo.js. macOS APFS collapses the pair on git checkout, so the published tarball was missing Foo.js. Rebuilt the tarball in-memory by streaming both blobs straight from git via Python's tarfile, then patched the packument's dist.shasum / dist.integrity / _attachments[…].shasum to the new hashes. Verified the served tarball lists package/Foo.js, package/foo.js, package/package.json.

Verification

With verdaccio --config test/registry/config.yaml --listen 4873 (no uplink, fully offline):

All 24 packuments serve 200
All 40 tarballs serve 200, byte-identical to disk
All 40 (packument shasum, integrity) pairs match the on-disk tarball hashes

Notes for reviewer

config.yaml is unchanged
Procedure docs at the top of config.yaml are still correct for any future fixture that is on npmjs.org; this PR doesn't update them, since the @pnpm.e2e case is a one-off
Fixture set covers the Tier 1 surface: abc*, peer-{a,b,c}, pkg-with-1-dep, install-script / pre/post-install variants, support-different-architectures, the case-conflict edge case, etc.

Test plan

mise run test:bats Tier 1 suite passes with this storage and no network
Spot-check: tar -tzf test/registry/storage/@pnpm.e2e/with-same-file-in-different-cases/with-same-file-in-different-cases-1.0.0.tgz lists both Foo.js and foo.js

🤖 Generated with Claude Code

Note

Low Risk
Low risk: adds committed test fixtures only (Verdaccio packuments/tarball metadata) without changing production code, but increases repo/test-registry data and could break offline tests if any hashes/attachments are incorrect.

Overview
Mirrors a set of @pnpm.e2e/* tier-1 fixture packages into the committed Verdaccio storage under test/registry/storage/@pnpm.e2e/ so integration tests can run fully offline.

Adds the corresponding packuments (version metadata, dist tags, and tarball hash references) for fixtures covering peer-deps, optional deps, lifecycle scripts, plugin/bin packages, architecture-specific optionals, and the case-sensitive filename edge case (with-same-file-in-different-cases).

^{Reviewed by Cursor Bugbot for commit 6718563. Bugbot is set up for automated code reviews on this repo. Configure here.}

Mirror 24 @pnpm.e2e/* fixture packages (40 tarballs) into the committed Verdaccio storage so Tier 1 bats tests run fully offline. Sourced from pnpm/registry-mock — these are not published to npmjs.org, so the in-tree procedure (proxy: npmjs uplink) does not apply. Booted a Verdaccio against pnpm/registry-mock's prepublish config, npm-published only the fixtures we need, then copied the resulting storage dirs over. with-same-file-in-different-cases: rebuilt the tarball in-memory by streaming both Foo.js + foo.js straight from git blobs (a plain checkout collapses the pair on macOS APFS), then patched the packument shasum/integrity to the new hashes. Verified offline: every packument 200s, every tarball serves byte-identical to disk, and (shasum, integrity) match across all 40 (package, version) pairs. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

greptile-apps · 2026-04-30T21:35:45Z

Greptile Summary

This PR adds 24 @pnpm.e2e/* fixture packages (40 tarballs + 24 packument JSON files) to the committed Verdaccio storage under test/registry/storage/, enabling Tier 1 bats tests to run fully offline. The fixtures were sourced from pnpm/registry-mock rather than npmjs.org, with the with-same-file-in-different-cases tarball manually rebuilt to include both Foo.js and foo.js (working around macOS APFS case-collapsing).

All SHA-1 checksums in _attachments and dist.shasum fields across all 24 packuments were verified to match the committed tarballs. The patched with-same-file-in-different-cases-1.0.0.tgz correctly lists both package/Foo.js and package/foo.js, and its dist.integrity (sha512) and dist.shasum values are accurate.

Confidence Score: 5/5

Safe to merge — pure test fixture addition with all checksums verified correct

All 40 tarballs have SHA-1 checksums that match the values recorded in their respective packument JSON files. The patched with-same-file-in-different-cases tarball correctly contains both Foo.js and foo.js, and its SHA-512 integrity value matches. No production code was changed. The Verdaccio config is unchanged and consistent with the existing offline-storage pattern.

No files require special attention

Important Files Changed

Filename	Overview
test/registry/storage/@pnpm.e2e/with-same-file-in-different-cases/package.json	Manually patched packument — sha1 and sha512 integrity values verified to match the rebuilt tarball, which correctly contains both Foo.js and foo.js
test/registry/storage/@pnpm.e2e/abc/package.json	Two-version packument (1.0.0, 2.0.0) with correct peer and regular dependency declarations; sha1 values verified against tarballs
test/registry/storage/@pnpm.e2e/install-script-example/package.json	Install-script fixture package — presence of install scripts is intentional for testing; checksum verified
test/registry/storage/@pnpm.e2e/support-different-architectures/package.json	Architecture-conditional fixture package; largest tarball in the set (709 bytes); checksum verified
test/registry/storage/@pnpm.e2e/peer-c/package.json	Three-version peer dependency fixture (1.0.0, 1.0.1, 2.0.0); checksums match all three tarballs

_{Reviews (1): Last reviewed commit: "test(registry): mirror @pnpm.e2e/* tier-..." | Re-trigger Greptile}

Now that the @pnpm.e2e/* fixtures landed in test/registry/storage/ (via #424), three previously-skipped misc.ts ports become viable: - bin-on-PATH-in-root-postinstall (line 36) - run-script-invokes-dep-bin (line 219) - case-only-filename-collision-installs-cleanly (line 163) The case-collision port deliberately skips pnpm's StoreIndex-internal assertions (those probe pnpm-specific CAS internals) and instead asserts the user-visible parity guarantee: install succeeds and the package materializes under node_modules. Brings the misc.ts port to 8/37. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

github-actions · 2026-04-30T21:47:52Z

Benchmark changes

Versions:

aube: 1.5.1 -> 1.5.2
pnpm: 11.0.1 -> 11.0.3

Public ratios: warm installs vs Bun 3x -> 3x; warm installs vs pnpm 9x -> 7x.

Benchmark	aube	bun	pnpm
Fresh install (warm cache)	237ms -> 806ms (+240%)	728ms -> 2317ms (+218%)	2104ms -> 6027ms (+186%)
CI install (warm cache, GVS disabled)	564ms -> 3170ms (+462%)	742ms -> 3117ms (+320%)	2094ms -> 6004ms (+187%)
CI install (cold cache, GVS disabled)	2282ms -> 9549ms (+318%)	1895ms -> 10334ms (+445%)	5439ms -> 10464ms (+92%)

## Summary - Check off Phase 0 — `@pnpm.e2e/*` fixtures ([#424](#424)) and `add_dist_tag` helper ([#422](#422)) both landed. - Record `lifecycleScripts.ts` 8/21 ported via [#421](#421) with a done/remaining split. - Relabel Phase 2 as unblocked (was "depends on add_dist_tag helper"). - Refresh the conventions note now that the `@pnpm.e2e/*` fixtures are in-tree. ## Test plan - [ ] doc-only — render check on GitHub 🤖 Generated with [Claude Code](https://claude.com/claude-code)  --- > [!NOTE] > **Low Risk** > Documentation-only updates to the pnpm test-import tracking doc; no runtime or test behavior changes. > > **Overview** > Updates `test/PNPM_TEST_IMPORT.md` to mark Phase 0 infrastructure work as complete (mirrored `@pnpm.e2e/*` fixtures and the `add_dist_tag` helper), and records current Tier 1 progress for `lifecycleScripts.ts` (8/21 ported with done/remaining notes). > > Renames Phase 2 as *unblocked* now that `add_dist_tag` exists, and refreshes the translation conventions to prefer using the in-tree `@pnpm.e2e/*` fixtures when specific package shapes are required. > > <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 270cfc9. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup>  Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

jdx enabled auto-merge (squash) April 30, 2026 21:41

jdx merged commit aecb50f into main Apr 30, 2026
20 checks passed

jdx deleted the claude/epic-black-dd9777 branch April 30, 2026 21:42

jdx mentioned this pull request Apr 30, 2026

docs(test): mark phase 0 done and refresh pnpm import status #429

Merged

1 task

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

test(registry): mirror @pnpm.e2e/* tier-1 fixtures#424

test(registry): mirror @pnpm.e2e/* tier-1 fixtures#424
jdx merged 1 commit intomainfrom
claude/epic-black-dd9777

jdx commented Apr 30, 2026 •

edited by cursor Bot

Loading

Uh oh!

greptile-apps Bot commented Apr 30, 2026

Uh oh!

Uh oh!

github-actions Bot commented Apr 30, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

jdx commented Apr 30, 2026 • edited by cursor Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Why the in-tree procedure didn't apply

How

Special case: with-same-file-in-different-cases

Verification

Notes for reviewer

Test plan

Uh oh!

greptile-apps Bot commented Apr 30, 2026

Greptile Summary

Confidence Score: 5/5

Important Files Changed

Uh oh!

Uh oh!

github-actions Bot commented Apr 30, 2026

Benchmark changes

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

jdx commented Apr 30, 2026 •

edited by cursor Bot

Loading

Special case: `with-same-file-in-different-cases`