fix(ci): replace yarnPath with corepack, disable dependabot - #769
Conversation
|
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
📝 WalkthroughWalkthroughThe changes update dependency automation, standardize Corepack and Yarn usage, add explicit CI caching, centralize GitLab Node setup, and introduce Make targets for common repository commands. ChangesRepository tooling and developer workflows
Estimated code review effort: 2 (Simple) | ~15 minutes Merge Risk: 🔵 Low · up to This PR changes CI dependency setup and caching to use Corepack and shared caches. The cache key may allow native dependencies built for one runtime environment to be reused in another, potentially causing CI failures; this bounded risk should remain visible to the owner. Possibly related PRs
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## develop #769 +/- ##
========================================
Coverage 81.49% 81.49%
========================================
Files 112 112
Lines 2853 2853
Branches 616 616
========================================
Hits 2325 2325
Misses 436 436
Partials 92 92 🚀 New features to boost your workflow:
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/dependabot.yml:
- Around line 9-12: Update the repository dependency-automation configuration
associated with the Dependabot setup so automated security updates remain
enabled; remove or revise the repository-level setting that disables Dependabot
security updates, while preserving the existing version-update suppression.
In @.github/workflows/ci.yml:
- Around line 30-37: Add enableGlobalCache: false to both project-root
.yarnrc.yml files so Yarn uses the checked-in local .yarn/cache directories, and
ensure this configuration is applied consistently for all four cache steps in
the CI workflow.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 65b0d324-8bc5-4ed5-bbac-075e79182755
⛔ Files ignored due to path filters (1)
.yarn/releases/yarn-3.6.1.cjsis excluded by!**/.yarn/**
📒 Files selected for processing (5)
.github/dependabot.yml.github/workflows/ci.yml.gitignore.yarnrc.ymlrenovate.json
💤 Files with no reviewable changes (1)
- .gitignore
| # This file suppresses Dependabot *version* updates via open-pull-requests-limit | ||
| # for every directory Dependabot has ever scanned in this repo. | ||
| # Dependabot *security* updates are also disabled at the repo level | ||
| # (Settings -> Code security -> Dependabot security updates). |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -eu
printf '%s\n' '--- .github/dependabot.yml ---'
cat -n .github/dependabot.yml
printf '%s\n' '--- Dependabot-related repository configuration ---'
rg -n -i 'dependabot|security update|open-pull-requests-limit' .github README.md 2>/dev/null || true
printf '%s\n' '--- Repository status summary ---'
git diff --statRepository: druxt/druxt.js
Length of output: 3775
🌐 Web query:
GitHub Dependabot security updates open-pull-requests-limit 0 does not disable security updates repository setting
💡 Result:
Setting open-pull-requests-limit to 0 in your dependabot.yml file does not disable security updates; it only disables Dependabot version updates for that specific package ecosystem [1][2][3]. Dependabot security updates and version updates operate independently. The open-pull-requests-limit configuration option specifically controls the maximum number of open pull requests allowed for version updates [1][4][3]. Security update pull requests are never subject to this limit and are not restricted by it [1][5][2]. If you wish to manage or disable Dependabot security updates, you must do so through the repository's security settings or by configuring the security update feature directly, rather than using the version update configuration file [6]. Setting open-pull-requests-limit to 0 is exclusively a method for temporarily silencing standard dependency version updates [1][3].
Citations:
- 1: https://docs.github.com/en/code-security/reference/supply-chain-security/dependabot-options-reference
- 2: https://github.com/github/docs/blob/main/content/code-security/reference/supply-chain-security/dependabot-options-reference.md
- 3: https://help.github.com/en/enterprise-server@3.5/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
- 4: https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/customizing-dependency-updates
- 5: https://docs.github.com/en/code-security/reference/supply-chain-security/dependabot-options-reference?c=loopfyx
- 6: https://docs.github.com/github/managing-security-vulnerabilities/configuring-dependabot-security-updates
🏁 Script executed:
#!/bin/bash
set -eu
printf '%s\n' '--- dependency automation files ---'
git ls-files | rg -i '(^|/)(renovate(\.json|\.json5|\.jsonc)?|dependabot\.yml|package\.json|composer\.json|package-lock\.json|yarn\.lock|pnpm-lock\.yaml|composer\.lock)$' || true
printf '%s\n' '--- Renovate configuration ---'
for f in $(git ls-files | rg -i '(^|/)renovate(\.json|\.json5|\.jsonc)?$'); do
echo "### $f"
cat -n "$f"
done
printf '%s\n' '--- security and dependency workflows/configuration ---'
git ls-files .github | rg -i '(workflow|action|security|audit|depend|renovate)' || true
rg -n -i 'renovate|npm audit|yarn audit|pnpm audit|composer audit| osv|osv-scanner|dependabot|dependency.review|codeql|owner|sla|vulnerab' .github package.json renovate.json renovate.json5 renovate.jsonc 2>/dev/null || trueRepository: druxt/druxt.js
Length of output: 6407
🌐 Web query:
site:github.com/druxt/druxt.js security policy dependency vulnerabilities Renovate
💡 Result:
Renovate is an automated dependency management tool that helps maintain project security by continuously monitoring and updating dependencies, including those with known vulnerabilities [1]. While specific internal policy documentation was not retrieved in the search, Renovate integrates into development workflows by generating pull requests to update outdated or vulnerable packages, ensuring projects stay aligned with current security standards [2][3][4]. Users typically manage dependency updates through Renovate's configuration, which allows for customization of update behavior, such as grouping updates or prioritizing security patches. In practice, Renovate acts as a proactive agent that identifies dependency changes—such as moving to a new major or minor version—and manages the associated versioning files (e.g., package.json, yarn.lock) to remediate technical debt and security risks [2][4][1]. Many projects use Renovate in conjunction with other security scanning tools, like Snyk, to maintain visibility into known vulnerabilities and automate the remediation process [5][6].
Citations:
- 1: chore(deps): update actions/checkout action to v7 #756
- 2: b7ca7b1
- 3: 8e914b0
- 4: 01b317b
- 5: https://github.com/druxt/druxt.js
- 6: https://github.com/druxt/druxt.js/
🏁 Script executed:
#!/bin/bash
set -eu
printf '%s\n' '--- package scripts ---'
sed -n '1,110p' package.json
printf '%s\n' '--- CI workflow ---'
cat -n .github/workflows/ci.yml
printf '%s\n' '--- all workflow references to audit/remediation ---'
rg -n -i 'audit|vulnerab|dependabot|renovate|security|owner|sla' .github/workflows .github 2>/dev/null || trueRepository: druxt/druxt.js
Length of output: 15663
🌐 Web query:
Renovate documentation GitHub vulnerability alerts security updates packageRules disabled major updates automerge
💡 Result:
To configure Renovate regarding automerge, security updates, and major update behavior, you can use the following approaches within your renovate.json configuration file. Automerge Configuration You can control automerge behavior using the automerge option [1][2]. By default, automerge is disabled (false) [2]. To enable it, you can set "automerge": true [1][2]. It is common practice to enable automerge for non-major updates (minor, patch, pin, digest) while leaving major updates for manual review [2][3]. Example to automerge non-major updates: { "packageRules": [ { "matchUpdateTypes": ["minor", "patch", "pin", "digest"], "automerge": true } ] } Major Update Behavior To disable major updates, you can use the:disableMajorUpdates preset or configure it manually [4]: { "major": { "enabled": false } } GitHub Vulnerability Alerts Renovate can integrate with GitHub's vulnerability alerts to prioritize security fixes [5]. To enable this, ensure your repository has the Dependency graph and Dependabot alerts enabled on GitHub [6]. In your Renovate configuration, you can use the:enableVulnerabilityAlerts preset to raise pull requests when vulnerabilities are detected [7]. Combining Rules You can combine these settings using packageRules to apply specific behaviors to subsets of dependencies [2][3]. For example, if you want to disable automerge for all dependencies as a global override, you can use: { "packageRules": [ { "matchPackageNames": ["*"], "automerge": false } ] } Note that if a configuration option has a parent (like automerge within packageRules), it must be defined inside that object [2][3]. Refer to the official Renovate documentation for detailed configuration schemas and preset definitions [2][4].
Citations:
- 1: https://docs.renovatebot.com/key-concepts/automerge/
- 2: https://docs.renovatebot.com/configuration-options/
- 3: https://github.com/renovatebot/renovate/blob/main/docs/usage/configuration-options.md
- 4: https://docs.renovatebot.com/presets-default/
- 5: https://github.com/renovatebot/renovate/blob/68f623b5/docs/usage/upgrade-best-practices.md
- 6: Renovate security updates for GitHub Actions using Dependabot Alerts supported? renovatebot/renovate#17095
- 7: https://docs.renovatebot.com/presets-security/
Keep automated security remediation enabled.
Dependabot security updates are disabled at the repository level. Renovate does not configure vulnerability alerts. CI only audits dependencies; it does not create remediation PRs or define an owner and SLA. Re-enable Dependabot security updates, or configure an equivalent Renovate process with documented ownership and remediation deadlines.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/dependabot.yml around lines 9 - 12, Update the repository
dependency-automation configuration associated with the Dependabot setup so
automated security updates remain enabled; remove or revise the repository-level
setting that disables Dependabot security updates, while preserving the existing
version-update suppression.
| - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4 | ||
| with: | ||
| path: | | ||
| .yarn/cache | ||
| docs/nuxt/.yarn/cache | ||
| key: ${{ runner.os }}-yarn-${{ hashFiles('yarn.lock', 'docs/nuxt/yarn.lock') }} | ||
| restore-keys: | | ||
| ${{ runner.os }}-yarn- |
There was a problem hiding this comment.
🚀 Performance & Scalability | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
for dir in . docs/nuxt; do
(
cd "$dir"
corepack enable
cache_folder="$(yarn config get cacheFolder)"
global_cache="$(yarn config get enableGlobalCache)"
printf '%s\tcacheFolder=%s\tenableGlobalCache=%s\n' \
"$PWD" "$cache_folder" "$global_cache"
case "$cache_folder" in
./.yarn/cache|*/.yarn/cache) ;;
*) exit 1 ;;
esac
test "$global_cache" = "false"
)
doneRepository: druxt/druxt.js
Length of output: 901
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '%s\n' '--- workflow cache and setup sections ---'
sed -n '1,210p' .github/workflows/ci.yml
printf '%s\n' '--- relevant repository files ---'
git ls-files \
'.yarnrc.yml' \
'yarn.lock' \
'package.json' \
'docs/nuxt/.yarnrc.yml' \
'docs/nuxt/yarn.lock' \
'docs/nuxt/package.json' \
'.github/workflows/ci.yml'
printf '%s\n' '--- root configuration and manifest ---'
for file in package.json .yarnrc.yml; do
if test -f "$file"; then
printf '\n[%s]\n' "$file"
cat "$file"
fi
done
printf '%s\n' '--- docs/nuxt configuration and manifest ---'
for file in docs/nuxt/package.json docs/nuxt/.yarnrc.yml; do
if test -f "$file"; then
printf '\n[%s]\n' "$file"
cat "$file"
fi
doneRepository: druxt/druxt.js
Length of output: 12316
🌐 Web query:
Yarn 3.6.1 configuration defaults cacheFolder enableGlobalCache official documentation
💡 Result:
In Yarn 3.6.1, the enableGlobalCache and cacheFolder settings work together as follows: enableGlobalCache This setting defines whether Yarn uses a system-wide shared cache [1][2][3]. Default: true [1][2][4] Behavior: When enabled (default), Yarn ignores the cacheFolder configuration and stores all cache files within the globalFolder (typically located in your home directory) [1][2][3][5]. cacheFolder This setting defines the directory where downloaded packages are stored when the local cache is active [1][2][3]. Default: "./.yarn/cache" [1][2][3] Behavior: This setting is only respected when enableGlobalCache is set to false [1][2][6][5]. If you wish to store your cache in a custom local directory (often used to commit dependencies to version control), you must set enableGlobalCache: false in your.yarnrc.yml file, after which Yarn will use the path specified in cacheFolder [7][6][5]. To configure these settings, you can add them to your.yarnrc.yml file: enableGlobalCache: false cacheFolder: "./.yarn/cache" Alternatively, you can set them via environment variables using snake case: YARN_ENABLE_GLOBAL_CACHE and YARN_CACHE_FOLDER [1][2]. Note that environment variables take precedence over settings defined in.yarnrc.yml files [1][2].
Citations:
- 1: https://yarnpkg.com/configuration/yarnrc
- 2: https://v6.yarnpkg.com/configuration/yarnrc.html
- 3: https://documents.devdocs.io/yarn~berry/configuration/yarnrc.html
- 4: https://github.com/yarnpkg/berry/blob/da725b072f812d423735dc73639fe35a22d79b40/packages/yarnpkg-core/sources/Configuration.ts
- 5: cacheFolder ignored in user .yarnrc.yml file yarnpkg/berry#1282
- 6: https://yarnpkg.com/advanced/lexicon
- 7: https://yarnpkg.com/features/caching
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '%s\n' '--- available Yarn and Corepack tooling ---'
command -v yarn || true
command -v yarnpkg || true
command -v corepack || true
node --version || true
corepack --version || true
printf '%s\n' '--- repository cache configuration ---'
rg -n --hidden --glob '!yarn.lock' --glob '!docs/nuxt/yarn.lock' \
'^(cacheFolder|enableGlobalCache):|cacheFolder|enableGlobalCache|packageManager' \
. .github/workflows/ci.yml || true
printf '%s\n' '--- Yarn cache directories tracked by the repository ---'
for dir in .yarn/cache docs/nuxt/.yarn/cache; do
if test -d "$dir"; then
printf '%s: directory exists\n' "$dir"
find "$dir" -maxdepth 1 -type f | head -n 5
else
printf '%s: directory absent\n' "$dir"
fi
doneRepository: druxt/druxt.js
Length of output: 1505
Set Yarn to use the local cache.
Yarn 3.6.1 enables the global cache by default. Both .yarnrc.yml files omit enableGlobalCache: false, so Yarn does not use the cached .yarn/cache paths. Set this option in both project roots. Apply the change to all four cache steps.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/ci.yml around lines 30 - 37, Add enableGlobalCache: false
to both project-root .yarnrc.yml files so Yarn uses the checked-in local
.yarn/cache directories, and ensure this configuration is applied consistently
for all four cache steps in the CI workflow.
Source: MCP tools
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@Makefile`:
- Around line 25-30: Update the lint-all target to invoke both documented
checks, lint:format and lint:renovate, in addition to its existing lint commands
so every documented lint check runs.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 81db4e01-fbb3-414b-8981-2508fa8fc4e9
📒 Files selected for processing (4)
.gitpod.ymlAGENTS.mdCONTRIBUTING.mdMakefile
| lint-all: ## Run all lint checks (eslint, markdownlint, cspell, knip, audit) | ||
| yarn lint | ||
| yarn lint:md | ||
| yarn lint:cspell | ||
| yarn lint:knip | ||
| yarn lint:audit |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
Make lint-all run every documented lint check.
lint-all omits yarn lint:format and yarn lint:renovate, although AGENTS.md, Lines 47-50, documents both checks. A passing make lint-all can miss formatting and Renovate configuration failures.
Proposed fix
lint-all: ## Run all lint checks (eslint, markdownlint, cspell, knip, audit)
yarn lint
yarn lint:md
yarn lint:cspell
+ yarn lint:format
+ yarn lint:renovate
yarn lint:knip
yarn lint:audit📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| lint-all: ## Run all lint checks (eslint, markdownlint, cspell, knip, audit) | |
| yarn lint | |
| yarn lint:md | |
| yarn lint:cspell | |
| yarn lint:knip | |
| yarn lint:audit | |
| lint-all: ## Run all lint checks (eslint, markdownlint, cspell, knip, audit) | |
| yarn lint | |
| yarn lint:md | |
| yarn lint:cspell | |
| yarn lint:format | |
| yarn lint:renovate | |
| yarn lint:knip | |
| yarn lint:audit |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@Makefile` around lines 25 - 30, Update the lint-all target to invoke both
documented checks, lint:format and lint:renovate, in addition to its existing
lint commands so every documented lint check runs.
- Set enableGlobalCache: false in both .yarnrc.yml files so the CI actions/cache step caches the correct local .yarn/cache directory (Yarn 3.6.1 defaults to global cache otherwise) - Add lint:format and lint:renovate to Makefile lint-all target to match the CI lint suite
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.gitlab-ci.yml:
- Around line 49-54: Update the GitLab CI cache configuration to add a separate
cache entry for the docs/nuxt Yarn project, keyed by its lockfile and covering
docs/nuxt/.yarn/cache/ and docs/nuxt/node_modules/. Keep the existing
root-project cache entry unchanged.
- Around line 47-54: Update the CI cache key in the top-level cache
configuration to include both the runner architecture and the Node image
identifier alongside yarn.lock, ensuring node_modules native binaries are not
shared across incompatible environments.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: f43d526e-c7bc-464f-8f7a-dcd13ca4c05c
📒 Files selected for processing (4)
.cspell-project-words.txt.github/dependabot.yml.gitlab-ci.ymlrenovate.json
| image: node:16.20.1 | ||
| cache: | ||
| key: | ||
| files: | ||
| - yarn.lock | ||
| paths: | ||
| - .yarn/cache/ | ||
| - node_modules/ |
There was a problem hiding this comment.
🩺 Stability & Availability | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -eu
printf '%s\n' '--- CI structure and cache definitions ---'
sed -n '1,290p' .gitlab-ci.yml
printf '%s\n' '--- dependency and toolchain declarations ---'
for f in package.json yarn.lock .yarnrc.yml docs/nuxt/.yarnrc.yml docs/nuxt/package.json; do
if [ -f "$f" ]; then
echo "### $f"
sed -n '1,180p' "$f"
fi
done
printf '%s\n' '--- native dependency references ---'
rg -n --hidden --glob '!node_modules/**' --glob '!dist/**' '(^|["'\''])((@[^/"'\'']+/)?(deasync|re2))(["'\'']|@|:)|deasync|re2' .
printf '%s\n' '--- working-directory and runner settings ---'
rg -n --hidden --glob '.gitlab-ci.yml' 'extends:|image:|cache:|key:|paths:|before_script:|script:|cd |CI_RUNNER|tags:|yarn|corepack|working_directory|YARN' .Repository: druxt/druxt.js
Length of output: 25010
🏁 Script executed:
#!/bin/bash
set -eu
printf '%s\n' '--- native package lock entries and dependency context ---'
sed -n '9428,9465p' yarn.lock
sed -n '18490,18525p' yarn.lock
sed -n '18980,19025p' yarn.lock
sed -n '22070,22095p' yarn.lock
printf '%s\n' '--- all tracked Yarn configuration and lockfiles ---'
git ls-files '*yarn.lock' '*yarnrc.yml' '.gitlab-ci.yml'
printf '%s\n' '--- cache-path relationship to install locations ---'
python3 - <<'PY'
from pathlib import Path
ci = Path(".gitlab-ci.yml").read_text()
print("root cache includes node_modules/:", " - node_modules/" in ci)
print("root cache includes .yarn/cache/:", " - .yarn/cache/" in ci)
for p in [Path("node_modules"), Path(".yarn/cache"), Path("docs/nuxt/node_modules"), Path("docs/nuxt/.yarn/cache")]:
print(f"{p}: tracked={p.exists()} (source tree presence only)")
PY
printf '%s\n' '--- runner/image/architecture identifiers in repository ---'
rg -n --hidden --glob '!yarn.lock' --glob '!docs/nuxt/yarn.lock' --glob '!examples/**/yarn.lock' \
'node:16\.20\.1|platform|architecture|arch|amd64|arm64|aarch64|docker' .gitlab-ci.yml .github package.json docs/nuxt/package.json 2>/dev/null || trueRepository: druxt/druxt.js
Length of output: 6207
🌐 Web query:
GitLab CI cache key files cache paths runner architecture cache isolation documentation
💡 Result:
In GitLab CI/CD, caching is a mechanism used to speed up jobs by storing project dependencies or intermediate files between runs [1][2]. Below is a synthesis of the key components requested. Cache Key Files and Paths Cache keys are defined in the.gitlab-ci.yml file to identify and reuse cache archives [3][4]. - cache:key:files: Allows you to generate a cache key based on the SHA checksum of specific files (e.g., Gemfile.lock, package-lock.json, or yarn.lock) [1][4]. The cache key only changes when the content of these files changes, ensuring the cache is reused when dependencies remain stable [3][4]. - cache:paths: Defines the files and directories that should be cached. Paths must be relative to the project directory, as files outside this directory cannot be cached [1][2]. - cache:key:files_commits: A variation that generates keys based on the latest commit of specified files, causing the key to change whenever the files are updated, even if the content is otherwise identical [3][4]. Runner Architecture and Caching The runner architecture dictates how cache files are stored and accessed: - Local Caching: By default, caches are stored on the machine where the GitLab Runner is installed, often within the runner's home directory or as Docker volumes for Docker executors [1][2]. - Distributed Caching: To support multiple runners (e.g., autoscaling environments), runners can be configured to use distributed caching (e.g., via S3 or GCS buckets) [1][2][5]. This allows different runner instances to share the same cache. - Network-Mounted Caching: Runners sharing the same architecture can alternatively be configured to use a common, network-mounted directory (such as NFS) to share cache data [1][2]. Cache Isolation Cache isolation is primarily managed through key scoping and runner configuration: - Key Scoping: Caches are associated with specific keys. Jobs using the same key share the same cache, which can span different branches and pipelines [3][4]. You can use predefined variables like $CI_COMMIT_REF_SLUG in the cache key to scope caches to specific branches [6][2]. - Runner Isolation: GitLab-hosted runners on GitLab.com are highly isolated; they run in ephemeral VMs that are destroyed immediately after a single job completes [5][7]. These runners utilize a shared distributed cache (GCS) that is logically separated by project, ensuring security and preventing unauthorized access to cache data between different projects [5][7]. For detailed configuration options and syntax, refer to the official GitLab documentation on Caching in GitLab CI/CD and the CI/CD YAML syntax reference [1][3][4].
Citations:
- 1: https://docs.gitlab.com/ci/caching/
- 2: https://docs.gitlab.com/17.11/ci/caching/
- 3: https://docs.gitlab.com/ci/yaml/
- 4: https://docs.gitlab.com/18.6/ci/yaml/
- 5: https://docs.gitlab.com/ci/runners/hosted_runners/
- 6: https://docs.gitlab.com/ci/caching/examples/
- 7: https://gitlab.com/gitlab-org/gitlab/-/blob/4314b2629444276245c6336a57eafaafeed8342a/doc/ci/runners/index.md
Scope the native-module cache by runner architecture.
node_modules/ contains native packages such as deasync and re2, but the cache key hashes only yarn.lock. Jobs using different runner architectures can share this key and restore incompatible binaries. Add the runner architecture and Node image identifier to the key, or restrict the runner to one architecture.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.gitlab-ci.yml around lines 47 - 54, Update the CI cache key in the
top-level cache configuration to include both the runner architecture and the
Node image identifier alongside yarn.lock, ensuring node_modules native binaries
are not shared across incompatible environments.
| key: | ||
| files: | ||
| - yarn.lock | ||
| paths: | ||
| - .yarn/cache/ | ||
| - node_modules/ |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
# Expected: docs jobs use the root project, or define a docs-specific cache.
rg -n -C 25 \
'^(pages:preview|docs:review):|docs/nuxt|yarn ' \
.gitlab-ci.yml || true
printf '\nLockfiles and Yarn configuration files:\n'
fd -H -t f 'yarn\.lock$' .
fd -H -t f '\.yarnrc\.yml$' .Repository: druxt/druxt.js
Length of output: 7884
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
printf '%s\n' 'CI cache template:'
sed -n '35,60p' .gitlab-ci.yml
printf '\n%s\n' 'Root and docs Yarn configuration:'
cat .yarnrc.yml
printf '\n--- docs/nuxt/.yarnrc.yml ---\n'
cat docs/nuxt/.yarnrc.yml
printf '\n%s\n' 'Relevant package metadata:'
python3 - <<'PY'
import json
for path in ("package.json", "docs/nuxt/package.json"):
with open(path) as f:
data = json.load(f)
print(path)
print("packageManager:", data.get("packageManager"))
print("installConfig:", data.get("installConfig"))
PYRepository: druxt/druxt.js
Length of output: 1363
Cache the docs/nuxt Yarn project separately.
docs/nuxt has its own yarn.lock, .yarnrc.yml, .yarn/cache/, and node_modules/. The shared cache currently covers only the root project, so documentation dependencies are reinstalled on every job.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.gitlab-ci.yml around lines 49 - 54, Update the GitLab CI cache
configuration to add a separate cache entry for the docs/nuxt Yarn project,
keyed by its lockfile and covering docs/nuxt/.yarn/cache/ and
docs/nuxt/node_modules/. Keep the existing root-project cache entry unchanged.
Corepack / yarnPath fix: - Remove yarnPath from .yarnrc.yml, delete 3MB vendored Berry binary - Add enableGlobalCache: false to both .yarnrc.yml files - Replace cache: yarn in setup-node with corepack enable + actions/cache in all 4 GitHub Actions CI jobs - Root cause: yarnPath was how the runner's yarn 1.22 delegated to Berry, not via corepack; also blocked bot lockfile regeneration (#10632) Makefile + docs: - Add Makefile (setup, build, test, lint, lint-all, dev, docs, clean, help) - Update CONTRIBUTING.md, AGENTS.md, .gitpod.yml for corepack workflow Dependabot / Renovate separation: - renovate.json: automerge false, vulnerabilityAlerts disabled - dependabot.yml: 8 subdirectories, open-pull-requests-limit 0 (version PRs only; security PRs unaffected) - Dependabot security updates + private vuln reporting enabled via API - 19 stale Dependabot PRs closed Renovate hardening: - pinDigests scoped to github-actions only (global caused lockfile failures) - markdownlint-cli2 added to freeze list (Node 16 incompatible past 0.13) GitLab CI cache: - Hidden .node template with yarn.lock-keyed cache for .yarn/cache/ and node_modules/, scoped by Node image tag - Separate cache entry for docs/nuxt workspace - Eliminates flaky native module rebuilds (deasync, dtrace-provider)
b3835d7 to
1a6b032
Compare
1 participant
Summary
Removes
yarnPathfrom.yarnrc.ymland replaces it with corepack in CI, fixing the root cause that prevented both renovate and dependabot from regeneratingyarn.lock(YN0028).Problem
The
yarnPathdirective in.yarnrc.ymlwas the mechanism by which the GitHub runner's yarn 1.22.22 delegated to Yarn Berry 3.6.1. However,yarnPathalso broke bot lockfile regeneration (dependabot-core#10632), causing every bot-created dependency PR to fail CI withYN0028: The lockfile would have been modified by this install.Changes
CI infrastructure
yarnPathfrom.yarnrc.yml— corepack handles version pinning via thepackageManagerfield.yarn/releases/yarn-3.6.1.cjs(3MB binary, no longer needed)!.yarn/releasesfrom.gitignorebuild,lint,test-unit,test-e2e):cache: yarnfromsetup-node(it invoked yarn before corepack could be enabled)run: corepack enableaftersetup-nodeactions/cache@v4for.yarn/cacheanddocs/nuxt/.yarn/cacheRenovate config
markdownlint-cli2to freeze list (Node 16 incompatible past^0.13.0: newer versions pull instring-widthv6+ which uses the/vregex flag requiring Node 20+)Dependabot
dependabot.ymlto cover all 8 subdirectories (not just root/)dependabot.yml)Verification
corepack enable+yarn --version→ 3.6.1yarn install --immutablepassesyarn buildpasses (all 11 packages)After merge
Renovate and dependabot (if re-enabled) can regenerate lockfiles on their own — the entire class of YN0028 failures goes away.
Closes #760
Summary by CodeRabbit
Chores
Documentation