build: 添加postinstall脚本以收集使用统计信息#3436
Conversation
github-actions
Bot
added
3.x
概述在发布包生成过程中，添加了 postinstall 生命周期钩子。该钩子在安装时执行 变更
审查工作量估计🎯 2 (简单) | ⏱️ ~10 分钟 建议审查者
诗歌
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment Warning |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (2)
scripts/build-taro.mjs (1)
531-531:copy postinstall.js与build.mjs第 415 行逻辑一致建议在抽取公共 release 打包逻辑时把这一行也一起下沉。
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@scripts/build-taro.mjs` at line 531, The copy of postinstall.js is duplicated in build-taro.mjs (the await copy(join(__dirname, '../scripts/postinstall.js'), join(`${npmPublishDir}/postinstall.js`)) line) and should be folded into the shared release packaging logic used by build.mjs; refactor by removing this standalone copy from build-taro.mjs and invoking the existing common function or moving the copy call into the centralized release packager (reuse the same implementation that handles postinstall.js in build.mjs) so the operation uses the shared helper and npmPublishDir variable rather than duplicating the logic.scripts/build.mjs (1)
383-420:build.mjs与build-taro.mjs的 release 包生成逻辑几乎重复，建议抽取公用函数
generateReleasePackageJson和copyReleaseFiles这两段，除了name、删除的 icons 依赖、dist路径之外，与scripts/build-taro.mjs里的对应实现完全一致，本次新增的postinstall脚本/files/optionalDependencies/copy postinstall.js四处改动也被同步复制到了两个文件里。未来任何一处变更（例如后面要再加 opt‑out 文档、改遥测工具版本）都会再次面临"改一处漏一处"的风险。可考虑抽到
scripts/build-release-shared.mjs之类的公共模块，两个入口只传入不同的参数（name、dist、removeDep）。🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@scripts/build.mjs` around lines 383 - 420, The two duplicated functions generateReleasePackageJson and copyReleaseFiles should be extracted into a shared module (e.g., scripts/build-release-shared.mjs) that exports a single parameterized helper (e.g., buildRelease({ name, dist, removeDep })) or two smaller functions (generateReleasePackageJson and copyReleaseFiles) which accept parameters for name, dist path and dependency-to-remove; move the common logic (postinstall, files array, optionalDependencies, copying README/CHANGELOG/postinstall.js and lottie animation) into that shared module, implement removal of the specified dependency inside generateReleasePackageJson using the passed removeDep symbol, and update build.mjs and build-taro.mjs to import and call the shared helper with their respective name/dist/removeDep values (ensuring package.json write path still uses the provided dist), so future changes live in one place.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@scripts/build.mjs`:
- Around line 407-409: Replace the optionalDependencies entry that pins
'@jmfe/npm-usage-stats-tool' to 'latest' with a stable semver range or exact
version (e.g., '^1.0.0' or '1.2.3') in both places where it's defined (the
optionalDependencies object in scripts/build.mjs and the matching entry in
scripts/build-taro.mjs); also add or update the README to note this package is
an internal-only dependency hosted on a private registry so external users may
see 404/auth errors.
---
Nitpick comments:
In `@scripts/build-taro.mjs`:
- Line 531: The copy of postinstall.js is duplicated in build-taro.mjs (the
await copy(join(__dirname, '../scripts/postinstall.js'),
join(`${npmPublishDir}/postinstall.js`)) line) and should be folded into the
shared release packaging logic used by build.mjs; refactor by removing this
standalone copy from build-taro.mjs and invoking the existing common function or
moving the copy call into the centralized release packager (reuse the same
implementation that handles postinstall.js in build.mjs) so the operation uses
the shared helper and npmPublishDir variable rather than duplicating the logic.
In `@scripts/build.mjs`:
- Around line 383-420: The two duplicated functions generateReleasePackageJson
and copyReleaseFiles should be extracted into a shared module (e.g.,
scripts/build-release-shared.mjs) that exports a single parameterized helper
(e.g., buildRelease({ name, dist, removeDep })) or two smaller functions
(generateReleasePackageJson and copyReleaseFiles) which accept parameters for
name, dist path and dependency-to-remove; move the common logic (postinstall,
files array, optionalDependencies, copying README/CHANGELOG/postinstall.js and
lottie animation) into that shared module, implement removal of the specified
dependency inside generateReleasePackageJson using the passed removeDep symbol,
and update build.mjs and build-taro.mjs to import and call the shared helper
with their respective name/dist/removeDep values (ensuring package.json write
path still uses the provided dist), so future changes live in one place.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository UI
Review profile: CHILL
Plan: Pro
Run ID: 529d36fe-f1cb-4e26-918d-df2d84f65ca3
📒 Files selected for processing (3)
scripts/build-taro.mjsscripts/build.mjsscripts/postinstall.js
| optionalDependencies: { | ||
| '@jmfe/npm-usage-stats-tool': 'latest' | ||
| } |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
# First, let's examine the scripts/build.mjs file around lines 407-409
cd . && wc -l scripts/build.mjsRepository: jdf2e/nutui-react
Length of output: 83
🏁 Script executed:
# Check the build.mjs file around the mentioned lines
head -420 scripts/build.mjs | tail -30Repository: jdf2e/nutui-react
Length of output: 1528
🏁 Script executed:
# Check scripts/build-taro.mjs for lines 523-525
wc -l scripts/build-taro.mjsRepository: jdf2e/nutui-react
Length of output: 88
🏁 Script executed:
# Check build-taro.mjs around lines 523-525
if [ -f scripts/build-taro.mjs ]; then
sed -n '515,535p' scripts/build-taro.mjs
fiRepository: jdf2e/nutui-react
Length of output: 1093
🏁 Script executed:
# Check if there's a package.json with information about dependencies
cat package.json | grep -A 50 "optionalDependencies" | head -20Repository: jdf2e/nutui-react
Length of output: 43
🌐 Web query:
@jmfe/npm-usage-stats-tool npm registry public
💡 Result:
No evidence found of a package named "@jmfe/npm-usage-stats-tool" on the public npm registry. Extensive searches across npm registry pages, general web, GitHub, and people/LinkedIn profiles returned no matching results. Similar packages exist for npm usage/download stats (e.g., @mcptoolshop/registry-stats, npm-statistic), and the @jmfe scope has other packages like @jmfe/jm-jdshare, but not this specific one. It may be private, internal, unpublished, or a misspelling.
Citations:
- 1: https://npm-stat.com/
- 2: https://www.npmjs.com/package/usage-stats
- 3: https://registry.npmjs.org/%40mcptoolshop%2Fregistry-stats
- 4: https://registry.npmjs.org/npm-statistic
- 5: https://npmtrends.com/
- 6: https://registry.npmjs.org/@jsfe/form
- 7: https://registry.npmjs.org/jmf-subscription
- 8: https://registry.npmjs.org/%40jsfe%2Fmaterial
- 9: https://registry.npmjs.org/jmd-scripts
- 10: https://npm.io/package/@jmfe/jm-jdshare
optionalDependencies 不要使用 latest，请改为固定版本或 caret 范围
已确认 @jmfe/npm-usage-stats-tool 在 npm 公开注册表中不存在，这意味着：
- 不可复现：每次用户安装都会拉取当时的最新版本，下游行为可能突然变化，导致线上问题难以复现
- 供应链风险：
latesttag 可被仓库 owner 随时移动，一旦被劫持或发布恶意版本，所有下游安装都会执行新版本代码 - 外部用户体验差：由于该包仅存在于内部 registry，外网用户安装时会看到 404/认证失败的噪音日志
需要改为明确的语义化版本（例如 '^1.0.0' 或 '1.2.3'），并在 README 中说明这是内部依赖。两处都需要修改：
scripts/build.mjs第 407-409 行scripts/build-taro.mjs中的相同位置
♻️ 改法示例
optionalDependencies: {
- '@jmfe/npm-usage-stats-tool': 'latest'
+ '@jmfe/npm-usage-stats-tool': '^1.0.0'
}🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@scripts/build.mjs` around lines 407 - 409, Replace the optionalDependencies
entry that pins '@jmfe/npm-usage-stats-tool' to 'latest' with a stable semver
range or exact version (e.g., '^1.0.0' or '1.2.3') in both places where it's
defined (the optionalDependencies object in scripts/build.mjs and the matching
entry in scripts/build-taro.mjs); also add or update the README to note this
package is an internal-only dependency hosted on a private registry so external
users may see 404/auth errors.
2 participants
🤔 这个变动的性质是？
🔗 相关 Issue
💡 需求背景和解决方案
统计组件安装数据，内网生效
☑️ 请求合并前的自查清单
Summary by CodeRabbit
发行说明