mirror of
https://github.com/NousResearch/hermes-agent.git
synced 2026-07-21 16:18:55 +00:00
f8ddf4fd86
git diff on a lockfile is unreadable: npm reorders entries, rewrites
integrity hashes, and moves packages between nesting levels, so a
one-line package.json bump produces a thousand-line textual diff.
scripts/ci/lockfile_diff.py instead parses the `packages` map out of
both versions of every tracked package-lock.json (via `git show`),
reduces each to {install path: version}, and set-diffs the maps —
reorder/hash churn vanishes, leaving only actual version movement
(added / removed / updated, with nested dedup copies tracked
separately).
The lockfile-diff workflow posts the result as a Markdown table in a
PR comment gated behind a hidden marker: subsequent pushes PATCH the
existing comment instead of stacking new ones, and a push that reverts
all lockfile changes updates the comment to say so. Advisory only —
never fails on findings; fork PRs (read-only token) degrade to a
warning.
Wired through the ci.yml orchestrator with a new npm_lock lane in
classify_changes.py (fails open on .github/ changes per the existing
contract).
|
||
|---|---|---|
| .. | ||
| ci.yml | ||
| contributor-check.yml | ||
| deploy-site.yml | ||
| docker-lint.yml | ||
| docker.yml | ||
| docs-site-checks.yml | ||
| history-check.yml | ||
| js-autofix.yml | ||
| js-tests.yml | ||
| lint.yml | ||
| lockfile-diff.yml | ||
| osv-scanner.yml | ||
| skills-index-freshness.yml | ||
| skills-index.yml | ||
| supply-chain-audit.yml | ||
| tests.yml | ||
| upload_to_pypi.yml | ||
| uv-lockfile-check.yml | ||