migrate node-remediation-console-plugin to npm#79375
Conversation
WalkthroughThe CI configuration for the node-remediation-console project is updated to replace yarn with npm for the lint test step. The ChangesPackage Manager Update for Node Remediation Console CI
🎯 2 (Simple) | ⏱️ ~5 minutes 🚥 Pre-merge checks | ✅ 12✅ Passed checks (12 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
openshift-ci
Bot
added
the
approved
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In
`@ci-operator/config/medik8s/node-remediation-console/medik8s-node-remediation-console-main.yaml`:
- Line 23: The change replaces a Yarn install that previously suppressed
lifecycle scripts with plain `npm ci`, which runs scripts by default; update the
`commands` entry so the install step preserves the prior --ignore-scripts
behavior (i.e., run npm ci with --ignore-scripts) before running the lint step,
keeping the sequence in the `commands` key (refer to the existing commands
line).
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: 09b410c5-8596-446f-8b2b-ad8da9ab1a7e
📒 Files selected for processing (1)
ci-operator/config/medik8s/node-remediation-console/medik8s-node-remediation-console-main.yaml
| tests: | ||
| - as: lint | ||
| commands: yarn install --ignore-scripts && yarn run lint | ||
| commands: npm ci && npm run lint |
There was a problem hiding this comment.
🧩 Analysis chain
🌐 Web query:
Does npm cirun lifecycle scripts by default, and is--ignore-scriptsthe npm equivalent of Yarn v1install --ignore-scripts?
💡 Result:
Yes, npm ci runs lifecycle scripts by default [1]. These include scripts such as preinstall, install, and postinstall, which are executed after the dependencies are installed into node_modules [1]. Yes, --ignore-scripts is the npm equivalent of Yarn v1's install --ignore-scripts [2][3]. When the --ignore-scripts flag is passed to npm ci, it prevents the execution of these lifecycle scripts [2][4]. This is a common security practice in automated environments to avoid running untrusted code during the installation process [3][5]. Note that while --ignore-scripts prevents automatic execution of lifecycle scripts, it does not prevent the execution of scripts explicitly called via commands like npm run-script [6][4].
Citations:
- 1: https://docs.npmjs.com/cli/v8/using-npm/scripts
- 2: fix(ci): pay attention to --ignore-scripts npm/cli#2455
- 3: Make
yarn install --ignore-scriptsmore specific yarnpkg/yarn#7338 - 4: https://docs.npmjs.com/cli/v8/commands/npm-install-ci-test/
- 5: https://www.reddit.com/r/webdev/comments/179abvv/for_npm_packages_do_you_ignore_scripts_when_you/
- 6: https://docs.npmjs.com/cli/v9/commands/npm-ci/?v=true
Preserve previous --ignore-scripts install behavior for lint CI.
Line 23 changes semantics: npm ci runs lifecycle scripts by default, while the prior Yarn command explicitly suppressed them. This introduces unnecessary supply-chain/script-execution risk in a lint-only job.
Suggested change
- commands: npm ci && npm run lint
+ commands: npm ci --ignore-scripts && npm run lint📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| commands: npm ci && npm run lint | |
| commands: npm ci --ignore-scripts && npm run lint |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In
`@ci-operator/config/medik8s/node-remediation-console/medik8s-node-remediation-console-main.yaml`
at line 23, The change replaces a Yarn install that previously suppressed
lifecycle scripts with plain `npm ci`, which runs scripts by default; update the
`commands` entry so the install step preserves the prior --ignore-scripts
behavior (i.e., run npm ci with --ignore-scripts) before running the lint step,
keeping the sequence in the `commands` key (refer to the existing commands
line).
|
[REHEARSALNOTIFIER]
Prior to this PR being merged, you will need to either run and acknowledge or opt to skip these rehearsals. Interacting with pj-rehearseComment: Once you are satisfied with the results of the rehearsals, comment: |
|
/pj-rehearse |
|
@razo7: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
This change depends on medik8s/node-remediation-console#100, so we must merge this PR to test medik8s/node-remediation-console#100 on PR... |
|
/lgtm |
|
@razo7: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
openshift-merge-bot
Bot
added
the
rehearsals-ack
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: batzionb, razo7 The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
@batzionb: The following test failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
|
/pj-rehearse skip |
|
@razo7: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
openshift-merge-bot
Bot
merged commit 6d4c827
into
openshift:main
2 participants
Follow up on medik8s/node-remediation-console#100
Migrating node-remediation-console-plugin from yarn 1 to npm
Summary
This PR updates the OpenShift CI configuration for the
node-remediation-consolecomponent to support npm instead of Yarn v1, as a follow-up to upstream changes in the medik8s/node-remediation-console repository.Changes
The CI lint test step for the
mainbranch of node-remediation-console is updated to use npm:yarn install --ignore-scripts && yarn run lintnpm ci && npm run lintThis change is made in
ci-operator/config/medik8s/node-remediation-console/medik8s-node-remediation-console-main.yaml, which defines how the OpenShift CI system builds and tests the component.Note that the release branches (0.6, 0.8, 0.9, 0.10, 0.11) retain their Yarn-based configuration, as only the main development branch is being migrated to npm at this time.