unsloth/tests/studio/test_sync_allow_scripts_pins.py
Daniel Han f41617ad9f
Studio: auto-sync allowScripts pins after dependency bumps (#6136)
* Studio: npm v12 readiness for install-script gating

npm 12 (July 2026) stops running dependency install scripts unless they
are approved via allowScripts, and npm 11.16 already warns. Studio has
no git or remote URL deps anywhere, so script gating is the only
exposure:

- commit the allowScripts policy that npm approve-scripts writes for
  @biomejs/biome and msw, plus a manual fsevents entry: the tooling
  cannot match a darwin-only optional dep from Linux, but the strict
  check walks the platform independent ideal tree and flags it anyway
- drop the minimum-release-age npmrc alias; npm >=11.16 flags it as an
  unknown project config that stops working in npm 12
- approve bun's postinstall in the setup.sh / setup.ps1 bun bootstrap;
  under npm 12 defaults npm install -g bun otherwise leaves a broken
  stub and setup falls back to the slower npm install path
- fix the stale esbuild comment in studio-frontend-ci.yml: the vite 8
  chain ships napi binaries with no install scripts

* Studio: auto-sync allowScripts pins after dependency bumps

The allowScripts entries from #6128 are version pinned, so a biome or
msw bump strands the pin and the approval silently stops matching.
Dependabot cannot maintain the field, so:

- scripts/sync_allow_scripts_pins.py re-pins existing entries from the
  versions package-lock.json actually resolves. It never adds or
  removes entries, so approving a new script-bearing package stays a
  human decision. Bare names and non-exact specs are left alone.
- a pre-commit hook runs it with --fix; pre-commit.ci pushes the fix
  commit to PR branches, Dependabot's included, so stale pins heal
  without a human in the loop
- a Frontend CI step runs --check plus the offline unit tests as the
  backstop when pre-commit.ci is skipped

No dependabot.yml change needed: the /studio/frontend entry already
suppresses version PRs (security only) behind a 7 day cooldown.

* [pre-commit.ci] auto fixes from pre-commit.com hooks

for more information, see https://pre-commit.ci

* Make the sync hook robust to lost executable bits

The pre-commit.ci autofix commit dropped the script's exec bit, which
breaks a shebang-style entry. Invoke via python instead and restore
the bit.

* [pre-commit.ci] auto fixes from pre-commit.com hooks

for more information, see https://pre-commit.ci

---------

Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>
2026-06-10 02:35:37 -07:00

141 lines
4.4 KiB
Python

#!/usr/bin/env python3
"""Offline tests for scripts/sync_allow_scripts_pins.py."""
from __future__ import annotations
import json
import sys
import tempfile
from pathlib import Path
REPO_ROOT = Path(__file__).resolve().parents[2]
sys.path.insert(0, str(REPO_ROOT / "scripts"))
import sync_allow_scripts_pins as sync # noqa: E402
def write_fixture(tmp: Path, policy: dict, lock_packages: dict) -> None:
(tmp / "package.json").write_text(
json.dumps(
{
"name": "fixture",
"dependencies": {"a": "^1.0.0"},
"allowScripts": policy,
},
indent = 2,
)
+ "\n"
)
(tmp / "package-lock.json").write_text(
json.dumps(
{
"lockfileVersion": 3,
"packages": lock_packages,
}
)
+ "\n"
)
LOCK = {
"": {"name": "fixture"},
"node_modules/@biomejs/biome": {"version": "1.9.9", "hasInstallScript": True},
"node_modules/msw": {"version": "2.15.0", "hasInstallScript": True},
"node_modules/vite/node_modules/fsevents": {"version": "2.3.3", "hasInstallScript": True},
"node_modules/clean": {"version": "3.0.0"},
}
def test_split_spec():
assert sync.split_spec("fsevents") == ("fsevents", None)
assert sync.split_spec("@biomejs/biome") == ("@biomejs/biome", None)
assert sync.split_spec("@biomejs/biome@1.9.4") == ("@biomejs/biome", "1.9.4")
assert sync.split_spec("msw@2.14.3 || 2.15.0") == ("msw", "2.14.3 || 2.15.0")
def test_in_sync_is_clean():
with tempfile.TemporaryDirectory() as d:
tmp = Path(d)
write_fixture(
tmp,
{
"@biomejs/biome@1.9.9": True,
"msw@2.15.0": True,
"fsevents": True,
},
LOCK,
)
assert sync.main(["--check", "--dir", str(tmp)]) == 0
def test_stale_pin_fails_check_and_fix_repairs():
with tempfile.TemporaryDirectory() as d:
tmp = Path(d)
write_fixture(
tmp,
{
"@biomejs/biome@1.9.4": True, # stale, bumped to 1.9.9
"msw@2.14.3": False, # stale denial, bumped to 2.15.0
"fsevents": True, # bare: never stale
"ghost@9.9.9": True, # not in lockfile: left alone
"weird@*": True, # non-exact spec: left alone
},
LOCK,
)
assert sync.main(["--check", "--dir", str(tmp)]) == 1
assert sync.main(["--fix", "--dir", str(tmp)]) == 0
got = json.loads((tmp / "package.json").read_text())["allowScripts"]
assert got == {
"@biomejs/biome@1.9.9": True,
"msw@2.15.0": False, # value and key order preserved
"fsevents": True,
"ghost@9.9.9": True,
"weird@*": True,
}
assert list(got) == [
"@biomejs/biome@1.9.9",
"msw@2.15.0",
"fsevents",
"ghost@9.9.9",
"weird@*",
]
assert sync.main(["--check", "--dir", str(tmp)]) == 0
def test_multi_version_disjunction():
lock = dict(LOCK)
lock["node_modules/x/node_modules/msw"] = {"version": "2.14.3", "hasInstallScript": True}
with tempfile.TemporaryDirectory() as d:
tmp = Path(d)
write_fixture(tmp, {"msw@2.14.3": True}, lock)
assert sync.main(["--fix", "--dir", str(tmp)]) == 0
got = json.loads((tmp / "package.json").read_text())["allowScripts"]
assert got == {"msw@2.14.3 || 2.15.0": True}
def test_no_policy_is_noop():
with tempfile.TemporaryDirectory() as d:
tmp = Path(d)
(tmp / "package.json").write_text(json.dumps({"name": "fixture"}) + "\n")
(tmp / "package-lock.json").write_text(json.dumps({"packages": {}}) + "\n")
before = (tmp / "package.json").read_text()
assert sync.main(["--fix", "--dir", str(tmp)]) == 0
assert (tmp / "package.json").read_text() == before
def test_missing_files_is_noop():
with tempfile.TemporaryDirectory() as d:
assert sync.main(["--check", "--dir", d]) == 0
if __name__ == "__main__":
failures = 0
for name, fn in sorted(globals().items()):
if name.startswith("test_") and callable(fn):
try:
fn()
print(f"PASS {name}")
except AssertionError as e:
failures += 1
print(f"FAIL {name}: {e}")
sys.exit(1 if failures else 0)