Files
artcraft/script/common/frontend_preflight.sh
T
Dylan M. Taylor 0c11395467 Sonar: clear the shell, workflow, Rust and HTML findings (#2818)
Clears the open SonarCloud issues outside the TypeScript frontend,
except the Rust ones, which moved to #2823 so each PR stays small.
Compile and tests are left to CI.

**Security**
- `frontend/api_docs.html` (Web:S5725): `integrity` (sha384 of the
pinned `swagger-ui-dist@5.32.0` files) and `crossorigin="anonymous"` on
the three unpkg assets, over `https:`.
- S6505: `--ignore-scripts` on `npm install` / `npm ci` in the dev and
build scripts and in the macOS and Windows publish workflows.
`artcraft-linux-publish.yml` already builds with `npm ci
--ignore-scripts`, and the frontend has no install scripts of its own.
- S7637: `dtolnay/rust-toolchain@stable` and
`tauri-apps/tauri-action@v0` pinned by commit SHA. For tauri-action
that's the commit `v0` points to (`84b9d35…`). The Linux workflow had
pinned the tag object instead, and is fixed the same way.
- S6505 / S8543: the macOS build runs `./node_modules/.bin/nx` instead
of `npx nx`, as the Linux workflow does.

**Reliability**
- shell:S7688: `[[ ]]` in place of `[` / `test` in
`frontend_preflight.sh` and the Linux packaging scripts.

**Analysis scope** (`sonar-project.properties`), each with its reason in
the file:
- Not analysed: `crates/vendor/**` (third-party), the upstream Python
reference implementations beside the Grok and Sora clients (nothing runs
them), and the hand-run developer tools `frontend/scripts/unix-dev.mjs`
and `frontend/tools/performance/**`. These held the S8564, S1244, S2245,
S4036, S5443 and S8707 findings.
- rust:S4347 not raised on `DeterministicRng`, the fixed-seed generator
for tests.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
<!-- coderabbit-ai-generated:v1 -->

## Summary by CodeRabbit

* **Improvements**
* File downloads and database maintenance now use asynchronous
operations, helping the app remain responsive during these tasks.
  * API documentation assets load over HTTPS with integrity checks.
* **Build and Reliability**
* Build and publishing workflows use pinned tool versions and skip
package lifecycle scripts during dependency installation.
  * Linux packaging checks use consistent shell conditionals.
* Frontend builds use the locally installed Nx command where applicable.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
- typescript:S2187 not raised on the ApiManager tests, which build their
cases with shared helpers that call `it` (`BetaKeysApi.test.ts`).
typescript:S2819 not raised on `*.worker.ts`: a dedicated worker's
messages come only from the page that started it.
2026-11-10 21:39:12 -05:00

87 lines
3.0 KiB
Bash
Executable File

#!/usr/bin/env bash
# Shared preflight checks for the frontend dev/build scripts.
#
# Usage (from a script that has set ${frontend_path}):
#
# source "${root_dir}/script/common/frontend_preflight.sh"
# frontend_preflight "${frontend_path}"
# ...
# pushd "${frontend_path}"
# frontend_npm_install
#
# Node 20+ is required by Nx 21 and comfortably covers Vite 6.
FRONTEND_MINIMUM_NODE_MAJOR=20
frontend_preflight() {
local frontend_path="$1"
if [[ ! -d "${frontend_path}" ]]; then
echo "ERROR: frontend directory not found at: ${frontend_path}"
echo "Run this script from the repository root."
exit 1
fi
# --- Node and npm must be installed ---
if ! command -v node &>/dev/null; then
echo "ERROR: node is not installed (or not on PATH)."
echo "Install Node.js ${FRONTEND_MINIMUM_NODE_MAJOR}+ via nvm (https://github.com/nvm-sh/nvm),"
echo "https://nodejs.org, or:"
echo " brew install node"
exit 1
fi
if ! command -v npm &>/dev/null; then
echo "ERROR: npm is not installed (or not on PATH). It normally ships with Node.js."
echo "Reinstall Node.js to get it back."
exit 1
fi
# --- Node must be recent enough for Nx 21 / Vite 6 ---
local node_major
node_major=$(node --version | sed -E 's/^v([0-9]+).*/\1/')
if [[ "${node_major}" -lt "${FRONTEND_MINIMUM_NODE_MAJOR}" ]]; then
echo "ERROR: Node.js ${FRONTEND_MINIMUM_NODE_MAJOR}+ is required (found $(node --version))."
echo "Upgrade via nvm ('nvm install --lts') or https://nodejs.org."
exit 1
fi
# --- The frontend uses npm; stale pnpm state breaks installs ---
# pnpm was briefly adopted ("add pnpm to solve build issues") and then dropped
# ("fix(frontend): consume video-editor libs via nx path aliases, drop pnpm").
# A node_modules tree written by pnpm makes npm fail with ENOTEMPTY errors.
if [[ -e "${frontend_path}/pnpm-lock.yaml" ]] \
|| [[ -e "${frontend_path}/pnpm-workspace.yaml" ]] \
|| [[ -d "${frontend_path}/node_modules/.pnpm" ]]; then
echo "ERROR: Stale pnpm artifacts detected in ${frontend_path}."
echo "The frontend uses npm (pnpm was dropped; see frontend/README.md)."
echo "Clean up with:"
echo " cd ${frontend_path} && rm -rf node_modules pnpm-lock.yaml pnpm-workspace.yaml && npm install --ignore-scripts"
exit 1
fi
}
# Run `npm install` in the current directory. If it fails (typically from a
# corrupted node_modules tree, eg. an interrupted install or a leftover pnpm
# layout causing ENOTEMPTY rename errors), wipe node_modules and the nx cache
# and retry once before giving up.
frontend_npm_install() {
if npm install --ignore-scripts; then
return 0
fi
echo ""
echo "WARNING: npm install failed. node_modules may be corrupted (eg. an"
echo "interrupted install or a mixed npm/pnpm tree). Wiping and retrying..."
echo ""
rm -rf node_modules .nx
if ! npm install --ignore-scripts; then
echo ""
echo "ERROR: npm install failed again. See the npm output above and the"
echo "troubleshooting section in frontend/README.md."
exit 1
fi
}