From b7aae88df161fe0b9f445e08abe7e03bd6f8825d Mon Sep 17 00:00:00 2001 From: Odin Thomas Rochmann Date: Wed, 19 Aug 2026 19:06:00 +0200 Subject: [PATCH] chore: skip native build scripts by default in allowBuilds Sets all pnpm-workspace.yaml allowBuilds entries to false to avoid running native-binary install/build scripts on every install. agent-browser and koffi are rebuilt explicitly in the copilot cli-plugin's prepack instead. @vscode/vsce-sign is rebuilt explicitly before publishing the VS Code extension, with its own cache-save opt-out in node-setup. Removes the unused marketplace.yml debug workflow. --- ...ugin-copilot_skip-agent-browser-install.md | 5 +++ .github/actions/node-setup/action.yml | 5 ++- .github/workflows/ci.yml | 10 +++++ .github/workflows/marketplace.yml | 16 -------- packages/cli-plugins/copilot/package.json | 2 +- pnpm-workspace.yaml | 41 +++++++++++++------ 6 files changed, 49 insertions(+), 30 deletions(-) create mode 100644 .changeset/cli-plugin-copilot_skip-agent-browser-install.md delete mode 100644 .github/workflows/marketplace.yml diff --git a/.changeset/cli-plugin-copilot_skip-agent-browser-install.md b/.changeset/cli-plugin-copilot_skip-agent-browser-install.md new file mode 100644 index 0000000000..4dba8d0d18 --- /dev/null +++ b/.changeset/cli-plugin-copilot_skip-agent-browser-install.md @@ -0,0 +1,5 @@ +--- +"@equinor/fusion-framework-cli-plugin-copilot": patch +--- + +Internal: stop running `agent-browser`'s and `koffi`'s native-binary install scripts on every `pnpm install`. Both now build explicitly in this package's `prepack` script, so publishing still bundles the binaries but everyday installs no longer download them. diff --git a/.github/actions/node-setup/action.yml b/.github/actions/node-setup/action.yml index 3c9ad13fad..5b9557c950 100644 --- a/.github/actions/node-setup/action.yml +++ b/.github/actions/node-setup/action.yml @@ -3,6 +3,9 @@ description: General setup of node inputs: node-version: default: 24 + save-cache: + description: Whether to save the pnpm store cache on main (still restored either way) + default: 'true' runs: using: composite @@ -47,7 +50,7 @@ runs: # Only main writes new cache entries — PRs restore-and-reuse but never # save, so open PRs stop each spawning their own throwaway ~700MB entry. - name: Save pnpm store - if: github.ref == 'refs/heads/main' + if: github.ref == 'refs/heads/main' && inputs.save-cache == 'true' uses: actions/cache/save@v4 with: path: ${{ steps.pnpm-store.outputs.path }} diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index a47f33b42e..7594f13fad 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -101,6 +101,16 @@ jobs: - name: Setup node and install deps if: steps.check.outputs.should-publish == 'true' uses: ./.github/actions/node-setup + with: + save-cache: 'false' + + # allowBuilds disables this by default (pnpm-workspace.yaml) since it's + # only needed here; vsce needs the native signing binary to publish. + # keytar isn't needed: --azure-credential uses OIDC, not the PAT/keytar + # credential store that `vsce login` would use. + - name: Build vsce-sign signing binary + if: steps.check.outputs.should-publish == 'true' + run: pnpm rebuild @vscode/vsce-sign # Build the extension and its workspace dependencies (lsp, rules, core) # in the correct order — vsce does not run the "prepack" build hook. diff --git a/.github/workflows/marketplace.yml b/.github/workflows/marketplace.yml deleted file mode 100644 index 5e0588946b..0000000000 --- a/.github/workflows/marketplace.yml +++ /dev/null @@ -1,16 +0,0 @@ -name: Debug Identity -on: workflow_dispatch -permissions: - id-token: write - contents: read -jobs: - debug: - runs-on: ubuntu-latest - environment: vs-marketplace - steps: - - uses: azure/login@f5d393ae46f8fde4be8b75f32e3fc50e654ad0ca - with: - client-id: ${{ vars.AZURE_CLIENT_ID }} - tenant-id: ${{ vars.AZURE_TENANT_ID }} - allow-no-subscriptions: true - - run: az rest -u https://app.vssps.visualstudio.com/_apis/profile/profiles/me --resource 499b84ac-1321-427f-aa17-267ca6975798 \ No newline at end of file diff --git a/packages/cli-plugins/copilot/package.json b/packages/cli-plugins/copilot/package.json index 2519206404..329354b95a 100644 --- a/packages/cli-plugins/copilot/package.json +++ b/packages/cli-plugins/copilot/package.json @@ -21,7 +21,7 @@ "scripts": { "build": "tsc -b", "build:types": "tsc -b", - "prepack": "pnpm build" + "prepack": "pnpm rebuild agent-browser koffi && pnpm build" }, "keywords": [ "fusion-framework", diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index 8d19fc6ccb..688a19773b 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -47,15 +47,32 @@ overrides: zod: 4.4.3 allowBuilds: - '@azure/msal-node-extensions': true - '@parcel/watcher': true - '@vscode/vsce-sign': true - agent-browser: true - esbuild: true - keytar: true - koffi: true - leveldown: true - msw: true - tree-sitter: true - tree-sitter-javascript: true - tree-sitter-typescript: true + # only used by AuthProviderInteractiveBrowser's OS-level token cache, a + # dynamic import with its own error message when unavailable — not hit by + # any CI workflow (they authenticate via OIDC, not interactive browser auth). + '@azure/msal-node-extensions': false + # only needed for `pnpm build:docs` (sass-embedded's file watcher); vuepress + # falls back to its default watcher without it. + '@parcel/watcher': false + # only needed to sign/package the fusion-lint vscode extension (rare, manual). + '@vscode/vsce-sign': false + # postinstall downloads a native binary from GitHub on every install; only the + # copilot cli-plugin needs it, so its own prepack rebuilds it explicitly instead. + agent-browser: false + # vite/vitest/tsc all build correctly without esbuild's own install script; + # the platform-specific @esbuild/* optional package supplies the binary. + esbuild: false + # native credential-cache addon for interactive local auth; not needed in CI + # or by default. Run `pnpm rebuild keytar` if you need it locally. + keytar: false + # native install script (@github/copilot-sdk's only dependent); rebuilt in that + # plugin's prepack instead of on every install. + koffi: false + # pouchdb/leveldown's native binding is already unavailable on macOS arm64 + # regardless of this setting; not worth building on every install elsewhere. + leveldown: false + msw: false + # fusion-lint works fine without these; it doesn't require the native binding. + tree-sitter: false + tree-sitter-javascript: false + tree-sitter-typescript: false