Repository navigation
ci(e2e): commit the harness pnpm lockfile and install it frozen - #1382
Conversation
tests/e2e ignored pnpm-lock.yaml since the harness scaffold, so every CI run resolved the transitive graph afresh: runs were not reproducible and the dependency graph (hence Dependabot alerts) only saw the direct pins in package.json. Commit pnpm-lock.yaml (generated with pnpm 11, the version CI pins) and switch both installers -- the ci.yml e2e matrix and the real-provider semantic-embedding smoke -- to `pnpm install --frozen-lockfile`. package-lock.json stays ignored; the suite uses pnpm only. The resolved graph carried three open advisories, fixed here: - vitest / @vitest/coverage-v8 4.1.11 -> 4.1.12 (@vitest/mocker, GHSA-qxg6-89mg-rqv8, GHSA-xp26-3454-mjgp) - zod pinned to 4.6.7 via a pnpm override (GHSA-mrhx-c7xc-m3w5; no 3.x is patched). It arrives through @modelcontextprotocol/sdk (accepts zod 4) and as openai 4.x's optional peer, used only by its zod helpers, which the harness does not import.
|
No actionable comments were generated in the recent review.
 |
| Layer / File(s) | Summary |
|---|---|
E2E workspace dependency constraints tests/e2e/package.json, tests/e2e/pnpm-workspace.yaml, tests/e2e/.gitignore |
Vitest and coverage-v8 are updated to 4.1.12. The workspace overrides zod to ^4.6.6. The ignore entry for pnpm-lock.yaml is removed. |
Require the e2e harness and lockfile .github/workflows/ci.yml, .github/workflows/semantic-embedding-real-provider.yml |
Both e2e install steps use --frozen-lockfile. The main CI workflow errors if tests/e2e/package.json is absent. Its TypeScript check and e2e command no longer depend on a harness-presence condition. |
Priority:
Estimated code review effort: 2 (Simple) | ~10 minutes
Change: Other
Suggested reviewers: moonming
Merge Risk: 
286b6
-
The dependency and CI workflow changes are mergeable with no established current-head risk.
Pre-merge checks: 
-
Check name Status Explanation Description Check Check skipped - CodeRabbit’s high-level summary is enabled. Title check The title names the main change: the e2e harness pnpm lockfile is committed and installed with --frozen-lockfile. The raw summary covers the CI workflow change, the lockfile install flag in both insta… Linked Issues check Check skipped because no linked issues were found for this pull request. Out of Scope Changes check Check skipped because no linked issues were found for this pull request. E2e Test Quality Review PASS — The changed files only enforce and reproduce the existing E2E harness setup. The diff adds a pnpm v9 lockfile whose importer matches tests/e2e/package.json, records Vitest 4.1.12 and zod 4.6.…Security Check No security findings were introduced by this pull request. 1. Sensitive data exposure: No issues found. The diff does not add logging, serialization, responses, or credential persistence. The existing… Full details: Title check
-
Explanation
The title names the main change: the e2e harness pnpm lockfile is committed and installed with --frozen-lockfile. The raw summary covers the CI workflow change, the lockfile install flag in both install sites, and the .gitignore change. The objectives also cover the vitest bump, the zod override, and the missing-harness error. The title leaves out those secondary items, which is acceptable. It uses the conventional ci(e2e) prefix and is 63 characters long, under a single sentence.
Full details: E2e Test Quality Review
-
Explanation
PASS — The changed files only enforce and reproduce the existing E2E harness setup. The diff adds a pnpm v9 lockfile whose importer matches
tests/e2e/package.json, records Vitest 4.1.12 and zod 4.6.7, and uses--frozen-lockfileat both CI install sites. It also fails clearly when the harness is absent. No E2E test files, scenarios, assertions, mocks, shared state, or product logic changed, so the listed quality failure conditions are not introduced.
Full details: Security Check
-
Explanation
No security findings were introduced by this pull request. 1. Sensitive data exposure: No issues found. The diff does not add logging, serialization, responses, or credential persistence. The existing OpenAI key remains scoped to the test step and is not passed to the install step. 2. Unencrypted secrets in databases: No issues found. The pull request changes no database models, migrations, or writes. 3. Authorization and permission bypass: No issues found. The pull request changes no API endpoints or permission checks. 4. Cross-resource access: No issues found. The pull request changes no resource lookup or ownership validation. 5. TLS and cryptographic configuration: No issues found. The pull request changes no TLS settings. The lockfile resolves zod to 4.6.7, within the patched 4.x range. 6. Resource isolation and shared-resource safety: No issues found. The pull request changes no shared-resource operations. 7. Secret reference resolution: No issues found. The pull request changes no configuration reference resolution. The reviewed changes are limited to CI installation mode, harness dependency updates, the zod override, and the committed pnpm lockfile. The lockfile records vitest and
@vitest/coverage-v8at 4.1.12 and zod at 4.6.7.
-
Finishing Touches
-
🧪 Generate unit tests (beta)
-
- Commit to this branch
- Create a new PR
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Comment @coderabbitai help to get the list of available commands.
An exact 4.6.7 pin would hold the harness on that release past the next zod fix; ^4.6.6 keeps the advisory floor and lets a lockfile refresh move.
The job's "check harness exists" step set present=false when tests/e2e/package.json was absent, which skipped install, typecheck and the suite with a ::notice:: and left every leg green. It now fails with an ::error::. The pnpm pin's comment claimed to match local development; it now states what CI pins.
The e2e harness under
tests/e2ehas ignoredpnpm-lock.yamlsince the scaffold went in, so every CI run resolved the transitive dependency graph from scratch. That made runs non-reproducible, and the dependency graph (which is what Dependabot alerts read) only ever saw the direct pins inpackage.json.This commits
tests/e2e/pnpm-lock.yaml, generated with pnpm 11 (the version the workflows pin), and switches both places that install the harness topnpm install --frozen-lockfile: thee2ematrix inci.ymland the real-provider semantic-embedding smoke.package-lock.jsonstays ignored since the suite only uses pnpm. Nodependabot.ymlis added: alerts come from the dependency graph, which picks up a committedpnpm-lock.yamlon its own.Resolving the graph surfaced three open advisories, fixed here so the lockfile lands clean:
vitest/@vitest/coverage-v84.1.11 → 4.1.12, for@vitest/mocker(GHSA-qxg6-89mg-rqv8, GHSA-xp26-3454-mjgp).zodoverridden to^4.6.6(resolves 4.6.7) intests/e2e/pnpm-workspace.yaml(GHSA-mrhx-c7xc-m3w5, no 3.x release is patched). It comes in through@modelcontextprotocol/sdk, which accepts zod 4, and as an optional peer ofopenai4.x that only itsopenai/helpers/zodentry uses; the harness doesn't import that.Two related fixes in the same
e2ejob. It used to skip install, typecheck and the suite whenevertests/e2e/package.jsonwas absent (thecheck harness existsstep setpresent=falseand only emitted a::notice::), so every leg reported green with nothing run. It now fails with an::error::instead; the check stays explicit because pnpm exits 0 in a directory that haspnpm-workspace.yamlbut nopackage.json. And the comment on the pnpm pin, which claimed it matched what developers run locally, now just states that CI pins pnpm 11 (lockfile format v9); the pinned version itself is unchanged.pnpm auditon the new lockfile reports no known vulnerabilities. No product code changes; the harness typechecks and the e2e checks on this PR exercise the frozen install.🤖 Generated with Claude Code
Summary by CodeRabbit