socket-patch/.github/workflows/pnpm-compatibility.yml at main · SocketDev/socket-patch · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
name: pnpm hosted compatibility

on:
  # PRs: any crate source, but only the test files these capstones
  # compile (a later `!` pattern excludes, a later plain one re-includes).
  # Main pushes stay unfiltered.
  pull_request:
    paths:
      - '.github/actions/upload-artifact/**'
      - 'Cargo.lock'
      - 'Cargo.toml'
      - 'rust-toolchain.toml'
      - '.cargo/config.toml'
      - '.github/workflows/pnpm-compatibility.yml'
      - 'crates/**'
      - '!crates/**/*.md'
      - '!crates/socket-patch-node/**'
      - '!crates/socket-patch-core/tests/**'
      - '!crates/socket-patch-cli/tests/**'
      - 'crates/socket-patch-cli/tests/vex_e2e_common/**'
      - 'crates/socket-patch-cli/tests/e2e_redirect_pnpm_build.rs'
      - 'crates/socket-patch-cli/tests/e2e_vendor_pnpm_build.rs'
      - 'crates/socket-patch-cli/tests/common/cache_env.rs'
  push:
    branches: [main]
  workflow_dispatch:

permissions:
  contents: read

jobs:
  build:
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - name: Compile CLI and pnpm integration tests once
        run: |
          cargo test --locked -p socket-patch-cli --test e2e_redirect_pnpm_build --test e2e_vendor_pnpm_build --no-run --message-format=json > target-build.json
          python3 - <<'PY'
          import json, pathlib, shutil
          dest = pathlib.Path('target/pnpm-e2e')
          dest.mkdir(parents=True, exist_ok=True)
          shutil.copy2('target/debug/socket-patch', dest / 'socket-patch')
          names = {'e2e_redirect_pnpm_build': 'pnpm-e2e', 'e2e_vendor_pnpm_build': 'pnpm-vendor-e2e'}
          for line in pathlib.Path('target-build.json').read_text().splitlines():
              item = json.loads(line)
              name = item.get('target', {}).get('name')
              if name in names and item.get('executable'):
                  shutil.copy2(item['executable'], dest / names[name])
          for n in names.values():
              assert (dest / n).is_file(), n
          PY
      - uses: ./.github/actions/upload-artifact
        with:
          name: pnpm-e2e
          path: target/pnpm-e2e/
          if-no-files-found: error
          retention-days: 7

  install-proof:
    needs: build
    runs-on: ubuntu-latest
    timeout-minutes: 15
    strategy:
      fail-fast: false
      matrix:
        include:
          # 1.0.0 must explicitly refuse its non-durable shrinkwrap format.
          - {pnpm: '1.0.0', node: '10.24.1'}
          - {pnpm: '1.43.1', node: '10.24.1'}
          - {pnpm: '2.0.0', node: '10.24.1'}
          - {pnpm: '2.25.7', node: '10.24.1'}
          - {pnpm: '3.0.0', node: '10.24.1'}
          - {pnpm: '3.8.1', node: '10.24.1'}
          - {pnpm: '4.0.0', node: '16.20.2'}
          - {pnpm: '4.14.4', node: '16.20.2'}
          - {pnpm: '5.0.0', node: '16.20.2'}
          - {pnpm: '5.18.11', node: '16.20.2'}
          - {pnpm: '6.0.0', node: '16.20.2'}
          - {pnpm: '6.35.1', node: '16.20.2'}
          - {pnpm: '7.0.0', node: '16.20.2'}
          - {pnpm: '7.33.7', node: '16.20.2'}
          - {pnpm: '8.0.0', node: '16.20.2'}
          - {pnpm: '8.15.9', node: '16.20.2'}
          - {pnpm: '9.0.0', node: '24.11.1'}
          - {pnpm: '9.15.9', node: '24.11.1'}
          - {pnpm: '10.0.0', node: '24.11.1'}
          - {pnpm: '10.33.0', node: '24.11.1'}
          - {pnpm: '10.34.5', node: '24.11.1'}
          - {pnpm: '11.0.0', node: '24.11.1'}
          - {pnpm: '11.27.0', node: '24.11.1'}
          - {pnpm: '12.0.0', node: '24.11.1'}
          - {pnpm: '12.4.2', node: '24.11.1'}
    steps:
      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
        with:
          pattern: pnpm-e2e*
          merge-multiple: true
          path: bin
      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
        with:
          node-version: '24.11.1'
      - name: Install the pinned package manager
        env:
          PNPM_TEST_VERSION: ${{ matrix.pnpm }}
        run: |
          npm install --prefix "$RUNNER_TEMP/pnpm-tool" --no-audit --no-fund "pnpm@$PNPM_TEST_VERSION"
          echo "SOCKET_PATCH_PNPM_E2E_BIN=$RUNNER_TEMP/pnpm-tool/node_modules/.bin/pnpm" >> "$GITHUB_ENV"
      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
        with:
          node-version: ${{ matrix.node }}
      - name: Require installation, verified VEX, rollback and integrity rejection
        env:
          SOCKET_PATCH_PNPM_E2E_VERSION: ${{ matrix.pnpm }}
          SOCKET_PATCH_PNPM_E2E_REQUIRED: '1'
          SOCKET_NO_CONFIG: '1'
          SOCKET_NO_UPDATE_CHECK: '1'
        run: |
          chmod +x bin/socket-patch bin/pnpm-e2e
          export SOCKET_PATCH_PNPM_E2E_SOCKET_BIN="$PWD/bin/socket-patch"
          bin/pnpm-e2e pnpm_pinned_matrix --ignored --nocapture
      - name: Require vendored lifecycle and manifest-less VEX
        # pnpm >= 9: full vendored capstone (vendor + get --mode vendored);
        # 7-8: the legacy lifecycle; 1-6: vendoring refused, nothing attested.
        env:
          SOCKET_PATCH_PNPM_E2E_VERSION: ${{ matrix.pnpm }}
          SOCKET_PATCH_PNPM_E2E_REQUIRED: '1'
          SOCKET_NO_CONFIG: '1'
          SOCKET_NO_UPDATE_CHECK: '1'
        run: |
          chmod +x bin/socket-patch bin/pnpm-vendor-e2e
          export SOCKET_PATCH_PNPM_E2E_SOCKET_BIN="$PWD/bin/socket-patch"
          bin/pnpm-vendor-e2e pnpm_pinned_matrix --ignored --nocapture