Fixing flaky code-check CI - #2943
Merged
Merged
Conversation
Capture node_modules/electron state after npm ci on the x64 runner and re-run electron's install.js with DEBUG to diagnose the flaky "Electron failed to install correctly" failure. To be reverted. Co-authored-by: Cursor <cursoragent@cursor.com>
|
All alerts resolved. Learn more about Socket for GitHub. This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored. Ignoring alerts on:
|
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 2 potential issues.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 618a894. Configure here.
Node 24.16.0 has a regression that breaks extract-zip's stream.pipeline, so Electron 39.8.5's postinstall extraction stalls after the first entry and never writes path.txt. This made every test importing 'electron' fail with "Electron failed to install correctly". .nvmrc previously pinned only major "24", so setup-node resolved 24.15.0 (last green) in May but 24.16.0 (broken) in June. Pin to 24.15.0. Also reverts the temporary install diagnostics step. Co-authored-by: Cursor <cursoragent@cursor.com>
The previous lockfile was internally inconsistent: @lingui/cli depends on ramda but the lockfile omitted it, so `npm ci` didn't install ramda and `lingui compile` (locale:compile / build:ci) failed with "Cannot find module 'ramda'". Incremental `npm install --package-lock-only` reported "up to date" and did not repair it; deleting package-lock.json and regenerating restores ramda while preserving the audit overrides and electron 39.8.5. Co-authored-by: Cursor <cursoragent@cursor.com>
Restore the original lockfile (which keeps the cross-platform @rollup/rollup-* optional binaries needed by `npm ci` on Linux) and inject only the missing ramda@0.27.2 node that @lingui/cli requires. Supersedes the previous full regeneration, which was generated on macOS and dropped the Linux rollup binaries, breaking `npm ci` on CI. Co-authored-by: Cursor <cursoragent@cursor.com>
The branch lockfile was missing ~195 dependency nodes (e.g. ramda, pseudolocale and other @lingui/cli transitive deps), which broke `lingui compile` (locale:compile / build:ci) with "Cannot find module 'ramda' / 'pseudolocale'". Regenerating on macOS dropped the cross-platform @rollup/rollup-* optional binaries (breaking `npm ci` on Linux). Regenerating inside a Linux container (node 24.15) produces a complete lockfile containing both the @lingui deps and all platform optional binaries, while preserving the npm-audit overrides and electron 39.8.5. Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
The branch lockfile was missing a large part of the @lingui/cli dependency closure (ramda, pseudolocale, pofile, cli-table, an esbuild subtree, etc.), breaking `lingui compile` (build:ci) with "Cannot find module ...". Regenerated on a native Linux x64 runner so the lockfile contains the full dependency closure AND all platform-optional binaries (13 @parcel/watcher, 25 @rollup, 25 @esbuild variants), while preserving the npm-audit overrides and electron 39.8.5. Also removes the temporary gen-lock workflow. Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
The branch lockfile was missing the @lingui/cli dependency closure
(ramda, pseudolocale, pofile, etc.), breaking `lingui compile`
(build:ci). A single fresh `npm install` produced a lockfile that
`npm ci` rejected ("Missing brace-expansion@2.1.1") due to an npm
overrides self-inconsistency; running `npm install` twice stabilizes it.
This lockfile was regenerated on a native Linux x64 runner (double
install) and validated to pass `npm ci`. It includes the full @lingui
closure and all platform-optional binaries (13 @parcel/watcher, 25
@rollup, 25 @esbuild) while preserving the audit overrides and
electron 39.8.5.
Removes the temporary gen-lock workflow.
Co-authored-by: Cursor <cursoragent@cursor.com>
Contributor
Author
|
@SocketSecurity ignore npm/esbuild@0.25.5 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Note
Low Risk
Single-line toolchain pin with no application or security logic changes.
Overview
Pins the Node version used by code-check (and any tooling that reads
.nvmrc) from the loose24specifier to24.15.0, so CI and localnvminstalls resolve the same patch release instead of floating across 24.x builds.That alignment targets intermittent code-check failures caused by minor Node drift while keeping the major line on 24.
Reviewed by Cursor Bugbot for commit 1febfdc. Bugbot is set up for automated code reviews on this repo. Configure here.