Health report of package.json for CI use

[mxdvl]

What does this change?

Adds a new script that audits a package.json file:

• errors if the package.json file is invalid
• errors if there are mismatched peer dependencies
• errors if there are duplicate entries in dependencies, devDependencies and peerDependencies.

In the future it could also:

• error if peerDependencies do not have a matching pinned devDependencies to the minimum matching the range
• error if private packages have anything but devDependencies
• error if any of the dependencies’ peerDependencies are mismatched
• error if there are @types/* dependencies that are mismatched

Builds on the ideas in guardian/dotcom-rendering#7003

How to test

Run the following script:

deno run \
	--allow-net=registry.npmjs.org \
	--allow-read=. \
	https://raw.githubusercontent.com/guardian/actions-npm-dependencies/mxdvl/initial-script/main.ts \
	./package.json  \
	--verbose --cache

How can we measure success?

Less mismatched dependencies, no duplicate dependencies.

Have we considered potential risks?

There could be false positives or negatives if this is not done this right, which would prevent adoption.

Images