mirror of
https://github.com/kuhyx/utils.git
synced 2026-11-11 13:07:46 +01:00
Krzysztof kuhy Rudnicki
1439c0f5c0
Two things that were fine in utils and would not have been in the next forty repos. **The allowlist is now fleet-wide plus per-repo.** `typescript-eslint` blocks TS 7 in EVERY repo that pins typescript -- eight of them and counting -- and a repo-only allowlist meant hand-copying one entry into eight files that then rot independently. That is the four-way fork of the 250-line cap, reproduced inside the mechanism built to avoid it. `~/utils/dependency-freshness.allowlist.yaml` is inherited by every repo; a repo entry for the same `ecosystem:package` overrides it. Inherited entries are exempt from the no-longer-needed check everywhere except the repo that owns the file. Without that carve-out a fleet-wide hold on typescript exits 2 in every Flutter app -- it excuses nothing there, which is the normal case, not rot -- and those repos become uncommittable. Confirmed against punchme, which now exits 0 while utils still reports the entry as in use. **`quarantine.py` bypassed the cache entirely.** It ran for every npm finding and fetched the FULL packument -- 7MB for react, 16MB for typescript -- with no TTL and no reuse, inside a pre-commit hook. One finding in utils, but the JS repos ahead have 16 to 37 each. Now cached under the normal 6h TTL, keyed `<name>@<dist-tag>`: the tag has to be part of the key rather than clamped afterwards, because clamping returns the ceiling and the ceiling is frequently the very release the quarantine is excluding. **Both cache and shared allowlist are now redirected by AUTOUSE fixtures.** A quarantine test had already seeded a fake answer for package "x" into the real ~/.cache/dep-freshness/registry.json, and the next run read its own pollution back and passed for the wrong reason. Removed the entry; the fixture makes it unrepeatable. 292 tests, 100% branch coverage on every module. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CRykabMwPgDzFHcARoqpaK
126 lines
5.0 KiB
Python
126 lines
5.0 KiB
Python
"""Static data for the dependency-freshness gate.
|
|
|
|
Every tunable lives here so `config.py` stays a re-export surface and the
|
|
ecosystem modules stay pure logic. Changing a registry URL, a TTL or the Node
|
|
release channel is a one-line edit in this file and nowhere else.
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
from typing import Final
|
|
|
|
# --- Ecosystems -------------------------------------------------------------
|
|
|
|
PUB: Final = "pub"
|
|
PYPI: Final = "pypi"
|
|
NPM: Final = "npm"
|
|
CARGO: Final = "cargo"
|
|
GOMOD: Final = "gomod"
|
|
GITTAG: Final = "gittag"
|
|
TOOLCHAIN: Final = "toolchain"
|
|
|
|
ECOSYSTEMS: Final = (PUB, PYPI, NPM, CARGO, GOMOD, GITTAG, TOOLCHAIN)
|
|
|
|
# --- Registry endpoints -----------------------------------------------------
|
|
|
|
PUB_API: Final = "https://pub.dev/api/packages/{name}"
|
|
PYPI_API: Final = "https://pypi.org/simple/{name}/"
|
|
NPM_API: Final = "https://registry.npmjs.org/{name}"
|
|
CRATES_API: Final = "https://crates.io/api/v1/crates/{name}"
|
|
GOPROXY_API: Final = "https://proxy.golang.org/{name}/@latest"
|
|
FLUTTER_RELEASES: Final = (
|
|
"https://storage.googleapis.com/flutter_infra_release/releases/"
|
|
"releases_linux.json"
|
|
)
|
|
NODE_RELEASES: Final = "https://nodejs.org/dist/index.json"
|
|
UTILS_TAG_REMOTE: Final = "https://github.com/kuhyx/utils"
|
|
|
|
# pnpm 11 quarantines packages younger than this before it will install them,
|
|
# to blunt the window in which a compromised publish is live. The gate matches
|
|
# it: reporting a repo as behind a version its package manager refuses to
|
|
# install is a failure nobody can act on. Its default is 1440 minutes.
|
|
NPM_QUARANTINE_HOURS: Final = 24
|
|
|
|
# crates.io 403s without one; npm/PyPI want a contactable agent too.
|
|
USER_AGENT: Final = "kuhyx-dependency-freshness (+https://github.com/kuhyx/utils)"
|
|
|
|
# PyPI's modern index; the legacy JSON `info.version` leaks pre-releases.
|
|
PYPI_ACCEPT: Final = "application/vnd.pypi.simple.v1+json"
|
|
NPM_ACCEPT: Final = "application/vnd.npm.install-v1+json"
|
|
|
|
# --- Cache ------------------------------------------------------------------
|
|
|
|
CACHE_PATH_ENV: Final = "DEP_FRESHNESS_CACHE"
|
|
DEFAULT_CACHE_DIR: Final = "~/.cache/dep-freshness"
|
|
CACHE_FILE: Final = "registry.json"
|
|
TTL_SECONDS: Final = 6 * 3600
|
|
TTL_GITTAG_SECONDS: Final = 24 * 3600
|
|
HTTP_TIMEOUT: Final = 10.0
|
|
PROBE_TIMEOUT: Final = 2.0
|
|
MAX_WORKERS: Final = 8
|
|
|
|
# --- Toolchain targets ------------------------------------------------------
|
|
|
|
# Q2 read literally points at Node Current; this machine and every repo build
|
|
# against LTS, so the gate targets LTS. One-line switch to "current".
|
|
NODE_CHANNEL: Final = "lts"
|
|
|
|
# The interpreter is pacman-managed here. A gate satisfiable only by fighting
|
|
# the distro gets disabled, so Python is compared to what is INSTALLED.
|
|
PYTHON_SOURCE: Final = "installed"
|
|
|
|
# --- Manifest discovery -----------------------------------------------------
|
|
|
|
MANIFEST_GLOBS: Final = (
|
|
"pubspec.yaml",
|
|
"pyproject.toml",
|
|
"package.json",
|
|
"Cargo.toml",
|
|
"go.mod",
|
|
".fvmrc",
|
|
".nvmrc",
|
|
".python-version",
|
|
)
|
|
REQUIREMENTS_PATTERN: Final = r"^requirements.*\.txt$"
|
|
|
|
# `.utils` is where every CI workflow checks the shared gate out, INSIDE the
|
|
# repo being checked. Without it `--all` walks utils' own manifests and fails
|
|
# the consuming repo for staleness in a directory that repo does not own --
|
|
# which is exactly how punchme's first green local run turned red in CI.
|
|
EXCLUDED_DIRS: Final = frozenset({
|
|
".git", "node_modules", "build", "dist", ".dart_tool", ".venv", "venv",
|
|
"__pycache__", "target", "vendor", ".gradle", "ios", "macos", "windows",
|
|
".mypy_cache", ".pytest_cache", ".ruff_cache", "coverage", "htmlcov",
|
|
".idea", ".vscode", "Pods", ".fvm", ".utils",
|
|
})
|
|
|
|
# --- Constraint policy ------------------------------------------------------
|
|
|
|
# Q13: these resolve from the Flutter/Dart SDK or are lint packages coupled to
|
|
# it, so a caret range is allowed. An exact pin is still checked for staleness.
|
|
PUB_CARET_ALLOWED: Final = frozenset({
|
|
"flutter", "flutter_test", "flutter_localizations", "flutter_driver",
|
|
"flutter_web_plugins", "integration_test", "sky_engine",
|
|
"flutter_lints", "very_good_analysis", "lints",
|
|
})
|
|
|
|
# Packages that ship with the Flutter SDK: no registry version exists.
|
|
PUB_SDK_PACKAGES: Final = frozenset({
|
|
"flutter", "flutter_test", "flutter_localizations", "flutter_driver",
|
|
"flutter_web_plugins", "integration_test", "sky_engine",
|
|
})
|
|
|
|
# `dependency_overrides` is an unpinned dependency wearing a disguise.
|
|
PUB_OVERRIDE_KEY: Final = "dependency_overrides"
|
|
|
|
ALLOWLIST_FILE: Final = "dependency-freshness.allowlist.yaml"
|
|
|
|
# A blocker like "typescript-eslint does not support TS 7" holds in EVERY repo
|
|
# that pins typescript, so a repo-only allowlist would mean hand-copying one
|
|
# entry into eight files that then all rot independently -- the four-way fork
|
|
# of the 250-line cap, in the mechanism built to avoid it. The shared file in
|
|
# ~/utils is inherited; a repo entry for the same package overrides it.
|
|
SHARED_ALLOWLIST_ENV: Final = "DEP_FRESHNESS_SHARED_ALLOWLIST"
|
|
ALLOWLIST_MAX_DAYS: Final = 90
|
|
TRANSITIVE_PREFIX: Final = "transitive:"
|