chore(dev): migrate to yarn 4#295
Merged
Merged
Conversation
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughThis PR migrates the repo to Yarn 4 Plug'n'Play: pins Yarn 4.15.0 and adds ChangesYarn 4 Plug'n'Play Migration
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Suggested labels
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/codeql-analysis.yml:
- Around line 43-46: The workflow uses a mutable tag for the setup-node action
("uses: actions/setup-node@v6"); replace that tag with the action's full
40-character commit SHA to satisfy the pinned-action policy. Edit the job step
that contains uses: actions/setup-node@v6 (and its with: node-version: 24,
cache: yarn) to reference the specific commit SHA for actions/setup-node so the
workflow is pinned and immutable.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 6290b7dc-199b-42c3-81c4-f3a12ec4eb40
⛔ Files ignored due to path filters (9)
.yarn/sdks/integrations.ymlis excluded by!**/.yarn/**.yarn/sdks/typescript/bin/tscis excluded by!**/.yarn/**.yarn/sdks/typescript/bin/tsserveris excluded by!**/.yarn/**.yarn/sdks/typescript/lib/tsc.jsis excluded by!**/.yarn/**.yarn/sdks/typescript/lib/tsserver.jsis excluded by!**/.yarn/**.yarn/sdks/typescript/lib/tsserverlibrary.jsis excluded by!**/.yarn/**.yarn/sdks/typescript/lib/typescript.jsis excluded by!**/.yarn/**.yarn/sdks/typescript/package.jsonis excluded by!**/.yarn/**yarn.lockis excluded by!**/yarn.lock,!**/*.lock
📒 Files selected for processing (13)
.github/workflows/ci.yml.github/workflows/codeql-analysis.yml.gitignore.oxfmtrc.json.oxlintrc.json.vscode/extensions.json.vscode/settings.json.yarnrc.ymldocs/development.mddocs/plans/007-yarn-modern-migration.mdlint-staged.config.mjspackage.jsontsconfig.json
Coverage Report
File CoverageNo changed files found. |
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/ci.yml:
- Line 35: The CI uses a generic lint invocation that forwards flags to
sub-scripts (currently "run: yarn lint --format=github") which can route flags
to the wrong subcommand; replace that invocation with the CI-specific script
name by changing the workflow step to call "yarn lint:ci" so the
GitHub-formatted output is handled by the dedicated lint:ci script instead of
passing --format=github to the top-level "lint" script.
- Around line 23-25: Replace the mutable action tags with pinned full commit
SHAs for actions/checkout and actions/setup-node (i.e., change
actions/checkout@v6 and actions/setup-node@v6 to their respective full-sha refs)
and add with: persist-credentials: false to the actions/checkout step;
specifically update the checkout step (actions/checkout) to include the
with.persist-credentials: false setting and swap both uses lines to use the full
commit SHAs instead of the v6 tag.
In @.github/workflows/codeql-analysis.yml:
- Around line 40-41: Update the "Checkout repository" step that currently uses
"uses: actions/checkout@v6" to pin the action to a specific, immutable commit
SHA instead of the tag and add the "persist-credentials: false" input to the
checkout step; specifically modify the uses value (actions/checkout@...) to the
full commit SHA and add persist-credentials: false under that step so
credentials are not persisted to later workflow steps.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: cc858c69-17e7-4807-97cd-400f82becb1e
⛔ Files ignored due to path filters (1)
yarn.lockis excluded by!**/yarn.lock,!**/*.lock
📒 Files selected for processing (9)
.github/dependabot.yml.github/workflows/ci.yml.github/workflows/codeql-analysis.yml.oxfmtrc.json.yarnrc.ymldocs/development.mddocs/plans/007-yarn-modern-migration.mdlint-staged.config.mjspackage.json
💤 Files with no reviewable changes (1)
- .oxfmtrc.json
There was a problem hiding this comment.
♻️ Duplicate comments (2)
.github/workflows/ci.yml (1)
23-25:⚠️ Potential issue | 🟠 Major | ⚡ Quick winPin
actions/checkoutandactions/setup-nodeto full SHAs (still unresolved).These steps still use mutable
@v6tags. Please pin both actions to 40-character commit SHAs; also setpersist-credentials: falseon checkout for least-privilege handling in this read-only CI job.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/ci.yml around lines 23 - 25, The workflow uses mutable tags for actions — replace the two uses entries "actions/checkout@v6" and "actions/setup-node@v6" with their corresponding 40-character commit SHAs to pin versions, and add persist-credentials: false to the checkout step (the step that uses actions/checkout) to enforce least-privilege; update only the "uses" values and add the persist-credentials option in the checkout step while leaving corepack enable as-is..github/workflows/codeql-analysis.yml (1)
40-43:⚠️ Potential issue | 🟠 Major | ⚡ Quick win
actions/checkoutis still tag-pinned; switch to a full commit SHA.Good fix adding
persist-credentials: false, butuses: actions/checkout@v6is still mutable and should be pinned to an immutable 40-char SHA.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/codeql-analysis.yml around lines 40 - 43, The workflow uses a mutable tag for the checkout action ("uses: actions/checkout@v6"); replace that tag with the corresponding immutable 40-character commit SHA for the actions/checkout release you want to pin to (keep the existing "persist-credentials: false" setting). Locate the "uses: actions/checkout@v6" line in the workflow and update it to "uses: actions/checkout@<full-commit-sha>" so the action is pinned to a specific commit.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Duplicate comments:
In @.github/workflows/ci.yml:
- Around line 23-25: The workflow uses mutable tags for actions — replace the
two uses entries "actions/checkout@v6" and "actions/setup-node@v6" with their
corresponding 40-character commit SHAs to pin versions, and add
persist-credentials: false to the checkout step (the step that uses
actions/checkout) to enforce least-privilege; update only the "uses" values and
add the persist-credentials option in the checkout step while leaving corepack
enable as-is.
In @.github/workflows/codeql-analysis.yml:
- Around line 40-43: The workflow uses a mutable tag for the checkout action
("uses: actions/checkout@v6"); replace that tag with the corresponding immutable
40-character commit SHA for the actions/checkout release you want to pin to
(keep the existing "persist-credentials: false" setting). Locate the "uses:
actions/checkout@v6" line in the workflow and update it to "uses:
actions/checkout@<full-commit-sha>" so the action is pinned to a specific
commit.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 887f4a28-90f9-4546-8c47-faf7ddb3f262
📒 Files selected for processing (2)
.github/workflows/ci.yml.github/workflows/codeql-analysis.yml
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
.github/workflows/codeql-analysis.yml (1)
45-47: 🧹 Nitpick | 🔵 Trivial | ⚡ Quick winMove
corepack enableafteractions/setup-nodefor consistency with best practices.Enabling Corepack before Node setup can apply it to the runner's default Node rather than Node 24. Standard practice is to enable Corepack after installing the target Node version.
♻️ Recommended reordering
- name: Checkout repository uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 with: persist-credentials: false - - run: corepack enable - - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6 with: node-version: 24 cache: yarn + - run: corepack enable + - run: yarn install --immutable🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/codeql-analysis.yml around lines 45 - 47, The step invoking "corepack enable" is placed before the "uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e" step; move the run: corepack enable line so it executes immediately after the actions/setup-node step to ensure Corepack is enabled for the installed Node version (i.e., reorder the steps so actions/setup-node runs first, then run: corepack enable).
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/ci.yml:
- Around line 26-27: Move the "corepack enable" step so it runs after the
actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e step; specifically
locate the steps referencing the literal "corepack enable" command and the
"uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e" action in
the workflow and reorder them so setup-node executes first, then run corepack
enable to ensure Corepack is enabled for the configured Node version.
---
Outside diff comments:
In @.github/workflows/codeql-analysis.yml:
- Around line 45-47: The step invoking "corepack enable" is placed before the
"uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e" step; move
the run: corepack enable line so it executes immediately after the
actions/setup-node step to ensure Corepack is enabled for the installed Node
version (i.e., reorder the steps so actions/setup-node runs first, then run:
corepack enable).
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 27bad2ce-e6eb-46fb-b506-8b86a190dee2
📒 Files selected for processing (2)
.github/workflows/ci.yml.github/workflows/codeql-analysis.yml
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Overview
Migrate the project from Yarn Classic to Yarn 4 Plug'n'Play while keeping local development, editor diagnostics, hooks, and CI workflows aligned with the new dependency model.
Details
.yarnrc.ymlfor Plug'n'Play, and updates install behavior to use immutable Yarn installs.node_modules.node_modules-specific TypeScripttypeRootssetting so TypeScript resolves declared types through the active package manager.Summary by CodeRabbit
Documentation
Chores