mirror of
https://github.com/storytold/artcraft.git
synced 2026-11-12 04:42:16 +00:00
Clears the open SonarCloud issues outside the TypeScript frontend, except the Rust ones, which moved to #2823 so each PR stays small. Compile and tests are left to CI. **Security** - `frontend/api_docs.html` (Web:S5725): `integrity` (sha384 of the pinned `swagger-ui-dist@5.32.0` files) and `crossorigin="anonymous"` on the three unpkg assets, over `https:`. - S6505: `--ignore-scripts` on `npm install` / `npm ci` in the dev and build scripts and in the macOS and Windows publish workflows. `artcraft-linux-publish.yml` already builds with `npm ci --ignore-scripts`, and the frontend has no install scripts of its own. - S7637: `dtolnay/rust-toolchain@stable` and `tauri-apps/tauri-action@v0` pinned by commit SHA. For tauri-action that's the commit `v0` points to (`84b9d35…`). The Linux workflow had pinned the tag object instead, and is fixed the same way. - S6505 / S8543: the macOS build runs `./node_modules/.bin/nx` instead of `npx nx`, as the Linux workflow does. **Reliability** - shell:S7688: `[[ ]]` in place of `[` / `test` in `frontend_preflight.sh` and the Linux packaging scripts. **Analysis scope** (`sonar-project.properties`), each with its reason in the file: - Not analysed: `crates/vendor/**` (third-party), the upstream Python reference implementations beside the Grok and Sora clients (nothing runs them), and the hand-run developer tools `frontend/scripts/unix-dev.mjs` and `frontend/tools/performance/**`. These held the S8564, S1244, S2245, S4036, S5443 and S8707 findings. - rust:S4347 not raised on `DeterministicRng`, the fixed-seed generator for tests. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> <!-- coderabbit-ai-generated:v1 --> ## Summary by CodeRabbit * **Improvements** * File downloads and database maintenance now use asynchronous operations, helping the app remain responsive during these tasks. * API documentation assets load over HTTPS with integrity checks. * **Build and Reliability** * Build and publishing workflows use pinned tool versions and skip package lifecycle scripts during dependency installation. * Linux packaging checks use consistent shell conditionals. * Frontend builds use the locally installed Nx command where applicable. <!-- end of auto-generated comment: release notes by coderabbit.ai --> - typescript:S2187 not raised on the ApiManager tests, which build their cases with shared helpers that call `it` (`BetaKeysApi.test.ts`). typescript:S2819 not raised on `*.worker.ts`: a dedicated worker's messages come only from the page that started it.
87 lines
3.0 KiB
Bash
Executable File
87 lines
3.0 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Shared preflight checks for the frontend dev/build scripts.
|
|
#
|
|
# Usage (from a script that has set ${frontend_path}):
|
|
#
|
|
# source "${root_dir}/script/common/frontend_preflight.sh"
|
|
# frontend_preflight "${frontend_path}"
|
|
# ...
|
|
# pushd "${frontend_path}"
|
|
# frontend_npm_install
|
|
#
|
|
|
|
# Node 20+ is required by Nx 21 and comfortably covers Vite 6.
|
|
FRONTEND_MINIMUM_NODE_MAJOR=20
|
|
|
|
frontend_preflight() {
|
|
local frontend_path="$1"
|
|
|
|
if [[ ! -d "${frontend_path}" ]]; then
|
|
echo "ERROR: frontend directory not found at: ${frontend_path}"
|
|
echo "Run this script from the repository root."
|
|
exit 1
|
|
fi
|
|
|
|
# --- Node and npm must be installed ---
|
|
if ! command -v node &>/dev/null; then
|
|
echo "ERROR: node is not installed (or not on PATH)."
|
|
echo "Install Node.js ${FRONTEND_MINIMUM_NODE_MAJOR}+ via nvm (https://github.com/nvm-sh/nvm),"
|
|
echo "https://nodejs.org, or:"
|
|
echo " brew install node"
|
|
exit 1
|
|
fi
|
|
|
|
if ! command -v npm &>/dev/null; then
|
|
echo "ERROR: npm is not installed (or not on PATH). It normally ships with Node.js."
|
|
echo "Reinstall Node.js to get it back."
|
|
exit 1
|
|
fi
|
|
|
|
# --- Node must be recent enough for Nx 21 / Vite 6 ---
|
|
local node_major
|
|
node_major=$(node --version | sed -E 's/^v([0-9]+).*/\1/')
|
|
if [[ "${node_major}" -lt "${FRONTEND_MINIMUM_NODE_MAJOR}" ]]; then
|
|
echo "ERROR: Node.js ${FRONTEND_MINIMUM_NODE_MAJOR}+ is required (found $(node --version))."
|
|
echo "Upgrade via nvm ('nvm install --lts') or https://nodejs.org."
|
|
exit 1
|
|
fi
|
|
|
|
# --- The frontend uses npm; stale pnpm state breaks installs ---
|
|
# pnpm was briefly adopted ("add pnpm to solve build issues") and then dropped
|
|
# ("fix(frontend): consume video-editor libs via nx path aliases, drop pnpm").
|
|
# A node_modules tree written by pnpm makes npm fail with ENOTEMPTY errors.
|
|
if [[ -e "${frontend_path}/pnpm-lock.yaml" ]] \
|
|
|| [[ -e "${frontend_path}/pnpm-workspace.yaml" ]] \
|
|
|| [[ -d "${frontend_path}/node_modules/.pnpm" ]]; then
|
|
echo "ERROR: Stale pnpm artifacts detected in ${frontend_path}."
|
|
echo "The frontend uses npm (pnpm was dropped; see frontend/README.md)."
|
|
echo "Clean up with:"
|
|
echo " cd ${frontend_path} && rm -rf node_modules pnpm-lock.yaml pnpm-workspace.yaml && npm install --ignore-scripts"
|
|
exit 1
|
|
fi
|
|
}
|
|
|
|
# Run `npm install` in the current directory. If it fails (typically from a
|
|
# corrupted node_modules tree, eg. an interrupted install or a leftover pnpm
|
|
# layout causing ENOTEMPTY rename errors), wipe node_modules and the nx cache
|
|
# and retry once before giving up.
|
|
frontend_npm_install() {
|
|
if npm install --ignore-scripts; then
|
|
return 0
|
|
fi
|
|
|
|
echo ""
|
|
echo "WARNING: npm install failed. node_modules may be corrupted (eg. an"
|
|
echo "interrupted install or a mixed npm/pnpm tree). Wiping and retrying..."
|
|
echo ""
|
|
|
|
rm -rf node_modules .nx
|
|
|
|
if ! npm install --ignore-scripts; then
|
|
echo ""
|
|
echo "ERROR: npm install failed again. See the npm output above and the"
|
|
echo "troubleshooting section in frontend/README.md."
|
|
exit 1
|
|
fi
|
|
}
|