Fix gulp-zip import and add consistent modified time to zip#138
Conversation
gulp-zip 6.x switched to ESM exports, so CommonJS require now returns an object with a default property instead of the function directly. Also added explicit modifiedTime option for consistent behavior. Fixes DES-1353 https://claude.ai/code/session_01YXpwhKnsb98MQHXC5c5HLW
|
Warning Rate limit exceeded
Your organization is not enrolled in usage-based pricing. Contact your admin to enable usage-based pricing to continue reviews beyond the rate limit, or try again in 53 minutes and 32 seconds. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (2)
WalkthroughThe Estimated code review effort🎯 2 (Simple) | ⏱️ ~7 minutes 🚥 Pre-merge checks | ✅ 2 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@gulpfile.js`:
- Line 86: The zip call currently sets modifiedTime to new Date(), which yields
non-reproducible archives; change the modifiedTime passed to zip(filename,
{modifiedTime: ...}) to a stable, deterministic timestamp derived from a
reproducible source (e.g. parse process.env.SOURCE_DATE_EPOCH if present, else
fall back to a deterministic value such as a fixed epoch or package version/git
commit timestamp), ensuring the value is converted to a Date and used for all
entries so repeated runs produce identical archives.
- Line 11: The build fails with ERR_REQUIRE_ESM because gulp-zip v6.1.0 is ESM
but the gulpfile uses static require: const zip = require('gulp-zip').default;
fix by either (A) declaring a minimum Node version in package.json via
"engines": { "node": ">=22.12.0" } so static require of ESM is allowed, or (B)
changing the gulpfile to dynamically import the ESM package (use top-level await
or an async wrapper and replace the require usage with await import('gulp-zip')
and reference the .default export) so older Node versions work; choose one
approach and update package.json or the gulpfile accordingly.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
| '!gulpfile.js' | ||
| ]), | ||
| zip(filename), | ||
| zip(filename, {modifiedTime: new Date()}), |
There was a problem hiding this comment.
new Date() does not produce reproducible archives.
The PR description states this change "enables reproducible builds," but new Date() evaluates to the current wall-clock time on each invocation, so every build still produces a zip with different entry mtimes (and therefore a different archive hash). It only makes all entries within a single archive share one timestamp — not reproducible across runs.
For true reproducibility, derive the timestamp from a stable source such as SOURCE_DATE_EPOCH, the package version, or the last git commit time.
♻️ Suggested approach
- zip(filename, {modifiedTime: new Date()}),
+ zip(filename, {
+ modifiedTime: process.env.SOURCE_DATE_EPOCH
+ ? new Date(Number(process.env.SOURCE_DATE_EPOCH) * 1000)
+ : new Date(0)
+ }),📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| zip(filename, {modifiedTime: new Date()}), | |
| zip(filename, { | |
| modifiedTime: process.env.SOURCE_DATE_EPOCH | |
| ? new Date(Number(process.env.SOURCE_DATE_EPOCH) * 1000) | |
| : new Date(0) | |
| }), |
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@gulpfile.js` at line 86, The zip call currently sets modifiedTime to new
Date(), which yields non-reproducible archives; change the modifiedTime passed
to zip(filename, {modifiedTime: ...}) to a stable, deterministic timestamp
derived from a reproducible source (e.g. parse process.env.SOURCE_DATE_EPOCH if
present, else fall back to a deterministic value such as a fixed epoch or
package version/git commit timestamp), ensuring the value is converted to a Date
and used for all entries so repeated runs produce identical archives.
gulp-zip 6.x is pure ESM, so require('gulp-zip').default only works
on Node 22.12.0+ where synchronous require of ESM is enabled by
default. Make the requirement explicit to surface a clear error on
older Node versions instead of ERR_REQUIRE_ESM.
https://claude.ai/code/session_01YXpwhKnsb98MQHXC5c5HLW
The modifiedTime: new Date() option was speculative and unneeded. The gulp-zip 6.x default (preserve file stat mtimes) works correctly and matches the effective pre-6.x behavior. https://claude.ai/code/session_01YXpwhKnsb98MQHXC5c5HLW
…#138) * Fix yarn zip failing after gulp-zip 6.x update gulp-zip 6.x switched to ESM exports, so CommonJS require now returns an object with a default property instead of the function directly. Also added explicit modifiedTime option for consistent behavior. Fixes DES-1353 https://claude.ai/code/session_01YXpwhKnsb98MQHXC5c5HLW * Declare Node >=22.12.0 engine requirement gulp-zip 6.x is pure ESM, so require('gulp-zip').default only works on Node 22.12.0+ where synchronous require of ESM is enabled by default. Make the requirement explicit to surface a clear error on older Node versions instead of ERR_REQUIRE_ESM. https://claude.ai/code/session_01YXpwhKnsb98MQHXC5c5HLW * Remove unnecessary modifiedTime option from zip call The modifiedTime: new Date() option was speculative and unneeded. The gulp-zip 6.x default (preserve file stat mtimes) works correctly and matches the effective pre-6.x behavior. https://claude.ai/code/session_01YXpwhKnsb98MQHXC5c5HLW --------- Co-authored-by: Claude <noreply@anthropic.com>
2 participants
Summary
Updated the gulp-zip integration to use the default export and ensure consistent file timestamps in generated zip archives.
Key Changes
gulp-zipimport from named import to default export (.default)modifiedTimeoption to zip task to set a consistent modification timestamp for all files in the archiveImplementation Details
The
modifiedTimeoption ensures reproducible builds by setting all files in the zip to the same timestamp, rather than using their individual file modification times. This is particularly useful for consistent artifact generation across different build environments.https://claude.ai/code/session_01YXpwhKnsb98MQHXC5c5HLW