71 lines
2.6 KiB
JavaScript
71 lines
2.6 KiB
JavaScript
|
#!/usr/bin/env node
|
||
|
|
/**
|
||
|
|
* verify-lockfile-npm10.mjs
|
||
|
|
*
|
||
|
|
* GUARD — DO NOT DELETE.
|
||
|
|
*
|
||
|
|
* Why this exists (root cause, 2026-09-19):
|
||
|
|
* The Docker image pins `node:22-alpine` by digest, which ships npm 10.9.8.
|
||
|
|
* The repo's `package-lock.json` is tracked (upstream does NOT track it) and
|
||
|
|
* the Dockerfile runs `npm ci`. If the lockfile is regenerated with npm 11+,
|
||
|
|
* npm 11 DROPS the top-level optional entries `@emnapi/core` and
|
||
|
|
* `@emnapi/runtime` that npm 10 requires for its platform-complete resolve.
|
||
|
|
* The tag-triggered "Build and Push Docker Image" workflow then fails at
|
||
|
|
* `npm ci` with:
|
||
|
|
* Missing: @emnapi/runtime@<v> from lock file
|
||
|
|
* Missing: @emnapi/core@<v> from lock file
|
||
|
|
* This already happened once on tag v1.0.14.
|
||
|
|
*
|
||
|
|
* Rule: ALWAYS regenerate package-lock.json with npm 10.x (the version Docker
|
||
|
|
* uses), never with the developer's global npm 11+.
|
||
|
|
*
|
||
|
|
* Correct: npx -y npm@10.9.8 install --package-lock-only
|
||
|
|
* Wrong: npm install # global npm 11+ silently breaks Docker
|
||
|
|
*
|
||
|
|
* This script asserts the lockfile still carries the entries npm 10 needs.
|
||
|
|
* Wire it into CI / pre-commit; exit 1 = lockfile will break the Docker build.
|
||
|
|
*
|
||
|
|
* Usage: node scripts/verify-lockfile-npm10.mjs
|
||
|
|
*/
|
||
|
|
import { readFileSync } from "node:fs";
|
||
|
|
import { fileURLToPath } from "node:url";
|
||
|
|
import { dirname, join } from "node:path";
|
||
|
|
|
||
|
|
const here = dirname(fileURLToPath(import.meta.url));
|
||
|
|
const lockPath = join(here, "..", "package-lock.json");
|
||
|
|
|
||
|
|
let lock;
|
||
|
|
try {
|
||
|
|
lock = JSON.parse(readFileSync(lockPath, "utf8"));
|
||
|
|
} catch (err) {
|
||
|
|
console.error(`❌ Cannot read ${lockPath}: ${err.message}`);
|
||
|
|
process.exit(1);
|
||
|
|
}
|
||
|
|
|
||
|
|
const packages = lock.packages || {};
|
||
|
|
const required = ["node_modules/@emnapi/core", "node_modules/@emnapi/runtime"];
|
||
|
|
const missing = required.filter((key) => !packages[key]);
|
||
|
|
|
||
|
|
if (missing.length > 0) {
|
||
|
|
console.error(
|
||
|
|
[
|
||
|
|
"❌ package-lock.json is NOT npm-10-compatible — the Docker build will fail at `npm ci`.",
|
||
|
|
"",
|
||
|
|
` Missing top-level entries: ${missing.join(", ")}`,
|
||
|
|
"",
|
||
|
|
" Cause: the lockfile was regenerated with npm 11+, which drops the",
|
||
|
|
" top-level @emnapi entries that npm 10 (node:22-alpine in the Docker image) requires.",
|
||
|
|
"",
|
||
|
|
" Fix (run from repo root):",
|
||
|
|
" npx -y npm@10.9.8 install --package-lock-only",
|
||
|
|
" Then re-run: node scripts/verify-lockfile-npm10.mjs",
|
||
|
|
"",
|
||
|
|
" Do NOT use your global `npm install` to regenerate the lockfile.",
|
||
|
|
].join("\n"),
|
||
|
|
);
|
||
|
|
process.exit(1);
|
||
|
|
}
|
||
|
|
|
||
|
|
console.log(
|
||
|
|
`✅ package-lock.json is npm-10-compatible (found ${required.join(", ")}). Docker \`npm ci\` will succeed.`,
|
||
|
|
);
|