test(install): port pnpm circular-peers, trust-policy, and peer-deps-warning#434
Merged
test(install): port pnpm circular-peers, trust-policy, and peer-deps-warning#434
Conversation
Greptile SummaryPorts eight tests from The timeout fallback logic (probe Confidence Score: 5/5Safe to merge — no product code changed, tests are self-contained, and registry metadata is well-structured. All changes are bats tests and offline registry fixtures. The circular-peers timeout probe, trust-policy .npmrc writes, and static publication timestamps for trust-policy-ignore-after are all correct. No P0 or P1 findings. No files require special attention. Important Files Changed
Reviews (5): Last reviewed commit: "test(install): port pnpm peer-deps-warni..." | Re-trigger Greptile |
4711880 to
34675cc
Compare
3bc3641 to
55e8ae1
Compare
Ports pnpm/test/install/misc.ts:556 (covers pnpm/pnpm#8720, "do not hang on circular peer dependencies") to test/pnpm_install_misc.bats. pnpm's source fixture is a 100+-package real-world workspace that pulls @babel/core, ember-source, and friends from the live registry; we substitute a minimal two-package workspace where each peer-depends on the other. The regression guard is the resolver terminating, which exercises the 16-iteration fixed-point loop in aube-resolver/src/peer_context.rs. A 60s timeout fails fast on hang regressions instead of stalling the bats run. Also refreshes PNPM_TEST_IMPORT.md: - misc.ts count 10/37 -> 11/37 - peer-deps-warning (541) moves from "still need fixtures" to "documented divergences" — pnpm asserts a stdout warning + status 0 for unmet peers, aube is silent by default (bun/npm/yarn parity) and strict mode flips to a hard failure. The string-level coverage is already in test/peer_deps.bats:297. - trust-policy (578-643) was mislabeled as a "pnpm-specific feature"; aube does have trust-policy via aube-resolver/src/trust.rs and the trustPolicy/trustPolicyExclude/trustPolicyIgnoreAfter settings. Reframed as a fixture-import follow-up — needs @pnpm/e2e.test-provenance versions with differing dist.attestations.provenance, and the port has to thread config via .npmrc since aube doesn't expose --trust-policy as a CLI flag. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Ports the six trust-policy tests from pnpm/test/install/misc.ts to test/pnpm_install_misc.bats: - 578: install fails on trust-evidence downgrade - 589: --trust-policy=off bypasses the check - 600: --trust-policy-exclude=name@version exempts a single version - 612: --trust-policy-exclude=name (bare) exempts every version - 624: hard-fail on a downgraded optional dependency - 635: --trust-policy-ignore-after exempts older versions Mirrors @pnpm/e2e.test-provenance from registry.npmjs.org at versions 0.0.0, 0.0.4 (with SLSA provenance + GitHub trustedPublisher), and 0.0.5 (no trust evidence — the downgrade pnpm's check is designed for). Re-uses the existing @pnpm.e2e/has-untrusted-optional-dep@1.0.0 fixture for the optional-dep test. Uses the upstream tarballs verbatim (~1.5 KB each) so SHA-512 + shasum match registry metadata for offline integrity checks. pnpm exposes trust-policy through `--trust-policy=…` flags; aube reads `trustPolicy` / `trustPolicyExclude` / `trustPolicyIgnoreAfter` from .npmrc / pnpm-workspace.yaml / `AUBE_TRUST_POLICY` only — no CLI surface. Each port writes a small .npmrc instead of passing a flag, mirroring the same effective config. PNPM_TEST_IMPORT.md misc.ts count: 11/37 -> 17/37. The trust-policy "needs fixtures" stub from the prior commit is gone; the file no longer claims trust-policy is pnpm-specific. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Ports pnpm/test/install/misc.ts:541 (covers pnpm/pnpm#8538, "do not fail to render peer dependencies warning, when cache was hit during peer resolution") to test/pnpm_install_misc.bats. pnpm's version asserts status=0 + the warning string in stdout — pnpm warns by default. aube is silent by default (matching bun/npm/yarn), and `strict-peer-dependencies=true` is the only mode that surfaces the same `"Issues with peer dependencies found"` line. aube routes the diagnostic through a hard-fail, so this port asserts `assert_failure` + the warning string instead of pnpm's warn-and-succeed shape. The regression guard — that the peer-deps diagnostic renderer doesn't crash when peers are missing — is preserved either way. Substitutes pnpm's `@udecode/plate-*` packages (real npm deps not in our offline registry) with the mirrored `@pnpm.e2e/abc-parent-with-missing-peers`, which depends on `@pnpm.e2e/abc` and leaves abc's peer-a/peer-b/peer-c unsatisfied. PNPM_TEST_IMPORT.md misc.ts count: 17/37 -> 18/37. The peer-deps- warning entry moves from "Documented divergences" into the "Done" list with an inline note about the warn-vs-fail asymmetry. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
55e8ae1 to
ea11683
Compare
Benchmark changesVersions:
Public ratios: warm installs vs Bun 4x -> 9x; warm installs vs pnpm 5x -> 13x.
ea11683 vs da78de8 | aube/bun/pnpm | 3 scenarios | 3 runs | 500mbit/50ms | generated by Codex. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Three batches from
pnpm/test/install/misc.tsported into test/pnpm_install_misc.bats — closing the three "still need fixtures / pnpm-specific" gaps tracked in PNPM_TEST_IMPORT.md:Circular peer deps (misc.ts:556, covers pnpm/pnpm#8720). Synthesizes a two-package workspace where each peer-depends on the other in lieu of pnpm's 100+-package real-world fixture. The regression guard is the resolver terminating against the 16-iteration fixed-point loop in
aube-resolver/src/peer_context.rs. Probes fortimeout/gtimeout(Linux / macOS-with-coreutils) and falls back to running uncovered when neither is on PATH.Trust-policy block (misc.ts:578-643, 6 tests). Mirrored
@pnpm/e2e.test-provenancefromregistry.npmjs.orgat 0.0.0, 0.0.4 (with SLSA provenance + GitHub trustedPublisher) and 0.0.5 (no trust evidence — the downgrade pnpm's check is designed for). Re-uses the existing@pnpm.e2e/has-untrusted-optional-dep@1.0.0fixture for the optional-dep test. pnpm exposes--trust-policy=…as a CLI flag; aube readstrustPolicy/trustPolicyExclude/trustPolicyIgnoreAfterfrom.npmrc/pnpm-workspace.yaml/AUBE_TRUST_POLICYonly, so each port writes a small.npmrcinstead of passing a flag. The priorPNPM_TEST_IMPORT.mdnote labeling trust-policy a "pnpm-specific feature" was wrong — aube has it via crates/aube-resolver/src/trust.rs; the only thing missing was the fixture.Peer-deps-warning (misc.ts:541, covers pnpm/pnpm#8538). Strict-mode variant. pnpm asserts status=0 + the warning string — pnpm warns by default. aube is silent by default (matching bun/npm/yarn) and
strict-peer-dependencies=trueis the only mode that surfaces the same\"Issues with peer dependencies found\"line, routed through a hard-fail rather than warn-and-succeed. The regression guard — that the peer-deps diagnostic renderer doesn't crash when peers are missing — is preserved either way.@udecode/plate-*substituted with the mirrored@pnpm.e2e/abc-parent-with-missing-peers.misc.ts port count: 10/37 → 18/37.
Test plan
mise run test:bats test/pnpm_install_misc.bats— all 18 tests pass, including the new circular-peers, six trust-policy, and peer-deps-warning portsmise run test:bats test/peer_deps.bats— 15 tests still green (the existing strict-peer-dependencies coverage at peer_deps.bats:297 stays as the single-package counterpart to the new misc.ts:541 port)🤖 Generated with Claude Code
Note
Low Risk
Low risk: changes are limited to adding test cases and offline registry fixture data; no production logic is modified. Main risk is potential test flakiness from
timeoutavailability and new trust-policy fixture assumptions.Overview
Adds new pnpm-parity bats coverage in
test/pnpm_install_misc.batsfor circular peer dependency termination (aube install --lockfile-only), trust-policy enforcement (no-downgrade/off/exclude/ignore-after, including optional-dep behavior via.npmrc), and strict peer-dependency diagnostics (ensuring the warning renderer doesn’t crash).Updates
test/PNPM_TEST_IMPORT.mdprogress notes accordingly and mirrors a new offline registry fixture@pnpm/e2e.test-provenance(versions0.0.0,0.0.4,0.0.5) to support the trust-policy test matrix.Reviewed by Cursor Bugbot for commit ea11683. Bugbot is set up for automated code reviews on this repo. Configure here.