Build: Migrate sandbox generation to Yarn 4 with 7d npmMinimalAgeGate#34850
Closed
valentinpalkovic wants to merge 2 commits into
Closed
Build: Migrate sandbox generation to Yarn 4 with 7d npmMinimalAgeGate#34850valentinpalkovic wants to merge 2 commits into
valentinpalkovic wants to merge 2 commits into
Conversation
Strip Verdaccio / host-local Yarn settings (npmRegistryServer pointing at localhost:6001, unsafeHttpWhitelist, enableImmutableInstalls, logFilters, npmMinimalAgeGate, etc.) from `*\/after-storybook\/.yarnrc.yml` before the sandbox tree is pushed to `storybookjs/sandboxes`. Also drop install artifacts (`.yarn/cache`, `node_modules`, `.pnp.cjs`, `storybook-static`) from the published copy. `before-storybook/.yarnrc.yml` is intentionally untouched — its contents are the user-facing Yarn setup we want consumers to reproduce. Includes a regression test asserting the exact STRIP_KEYS / EXCLUDE_GLOBS contracts so mutations require a deliberate review.
Flip the default sandbox-generation Yarn version from classic to berry so the `before-storybook` directory ships with a Yarn 4 lockfile. After the template's CLI finishes bootstrapping, drop any non-Yarn-4 lockfile, re-pin `packageManager`, set `npmMinimalAgeGate` to 7 days, and run `yarn install` + `yarn up '*'` in `--mode=update-lockfile` to produce a deterministic dependency tree pinned to the newest non-quarantined versions matching the template's package.json ranges. `YARN_ENABLE_IMMUTABLE_INSTALLS=false` is passed via env, not written to `.yarnrc.yml`, so the consumer-facing config stays clean. Consumers who clone the published sandbox now reproduce the exact dependency tree at publish time, and freshly-published (potentially malicious) dependency versions are blocked by yarn's age gate on any subsequent local install. Failure of the refresh step is non-fatal — the template's default state is shipped instead, with a CI warning surfaced.
Contributor
Author
|
Reopening from upstream branch (correctly stacked); see follow-up PR. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Make the
before-storybookpublished sandbox tree:setupYarndefaultclassic→berry).yarn.lockthat consumers install from.npmMinimalAgeGate: 7dso freshly-published (potentially malicious) versions are skipped at publish time AND on any lateryarn installa consumer runs.This delivers the architectural fix the team agreed on: sandboxes become reproductions of a known good state at a single point in time, rather than "latest at consumption time."
What this PR does
scripts/sandbox/utils/yarn.ts:setupYarndefaultversionflips'classic'→'berry'.refreshBeforeStorybookLockfile({ cwd, debug })helper.scripts/sandbox/generate.ts:localizeYarnConfigFilesand beforemoveDir, runrefreshBeforeStorybookLockfilefor non-pnp templates.The refresh helper:
yarn.lock,package-lock.json,pnpm-lock.yaml).yarn set version berryto restore thepackageManagerfield that the template removed.yarn config set nodeLinker node-modules+yarn config set npmMinimalAgeGate 10080.yarn install --mode=update-lockfile+yarn up '*' --mode=update-lockfileto produce the lockfile.YARN_ENABLE_IMMUTABLE_INSTALLS=falsevia env (not.yarnrc.yml) to keep consumer config clean.What's intentionally NOT in this PR
sbInit --package-manager=YARN2flag flip — deferred. The after-storybook flow still uses the existing YARN1 path. This avoids coupling the before-storybook reproducibility fix with the after-storybook install-path migration.installYarn2destructive-rm rewrite — deferred. Still uses Build: Disable yarn npmMinimalAgeGate inside sandboxes #34846'sgate=0for the local CI sandbox build path.AGENTS.mdupdates on contributor minimum yarn version — follow-up if needed.Test plan
yarn nx run scripts:checkpassesyarn installproduces the lockfile-pinned tree🤖 Generated with Claude Code