Consume storyproof as a git dependency (experiment) - #256
Conversation
Replace the broken 0.0.1-alpha.1 registry placeholder with a git-hosted dependency on github.com/leon0399/storyproof#main (path:packages/storyproof). pnpm packs git-hosted deps, which runs the package's prepack (tsdown build), so the install ships a real dist/ built from source — verified by booting Storybook and running the full visual suite: 246 stories captured (196 new, 50 disabled-passed) under linux-chromium-1280x720@1x. Caveat that keeps this an experiment: pnpm approves git-hosted build scripts only by exact resolved spec (codeload URL + commit sha), so the allowBuilds entry must be re-approved on every storyproof main commit — neither the name, the git+https repo URL, nor the codeload base URL matched. Replace with a registry version once one is published past the cooldown. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
Caution The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased. |
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
You do not have enough credits to review this pull request. Please purchase more credits to continue. |
|
Warning Review limit reached
Next review available in: 33 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. 📝 WalkthroughWalkthroughStorybook now uses the ChangesStoryproof dependency integration
Estimated code review effort: 1 (Trivial) | ~5 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches 💡 1🛠️ Fix failing CI checks 💡
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@pnpm-workspace.yaml`:
- Around line 89-92: Update the comment above the storyproof allowBuilds entry
to state that it is pinned to a specific commit SHA and that changes resolving
to a different codeload URL require renewed approval; do not claim that branch
updates are covered automatically.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 9715e8e2-2ae8-4a88-8b4a-5d4d0675036a
⛔ Files ignored due to path filters (1)
pnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (2)
apps/storybook/package.jsonpnpm-workspace.yaml
| # Git-hosted packages are approved by repository URL, not name; this form | ||
| # covers every commit from the repo, so branch updates don't need | ||
| # re-approval. | ||
| "storyproof@https://codeload.github.com/leon0399/storyproof/tar.gz/95615e78bf6bdaca98b2fd5ba5b06d4377ee1319#path:packages/storyproof": true |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Correct the re-approval comment.
This allowBuilds entry is pinned to commit 95615e78bf6bdaca98b2fd5ba5b06d4377ee1319, so a new main commit will resolve to a different codeload URL and require a new approval. Update the comment to describe the SHA-specific behavior; otherwise maintainers may expect branch updates to install without changing allowBuilds.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@pnpm-workspace.yaml` around lines 89 - 92, Update the comment above the
storyproof allowBuilds entry to state that it is pinned to a specific commit SHA
and that changes resolving to a different codeload URL require renewed approval;
do not claim that branch updates are covered automatically.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: bb848beaf4
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| # Git-hosted packages are approved by repository URL, not name; this form | ||
| # covers every commit from the repo, so branch updates don't need | ||
| # re-approval. | ||
| "storyproof@https://codeload.github.com/leon0399/storyproof/tar.gz/95615e78bf6bdaca98b2fd5ba5b06d4377ee1319#path:packages/storyproof": true |
There was a problem hiding this comment.
When main advances and the lockfile is refreshed, pnpm identifies this git build by the newly resolved codeload URL and commit SHA, but this allowlist key hardcodes 95615e…. The new package will therefore have its required prepack blocked and, because dist/ is gitignored, Storybook will receive an unusable package. The adjacent claim that branch updates need no reapproval is the opposite of the exact-SHA behavior; either pin the dependency to this SHA or update the approval whenever it resolves to another commit.
Useful? React with 👍 / 👎.
| }, | ||
| "dependencies": { | ||
| "storyproof": "0.0.1-alpha.1", | ||
| "storyproof": "git+https://github.com/leon0399/storyproof.git#main&path:packages/storyproof", |
There was a problem hiding this comment.
This switches the shipped dependency from the published npm placeholder to the git-hosted main branch, while the newest relevant CHANGELOG.md entry still explicitly says llame consumes the published storyproof package pinned to 0.0.1-alpha.1. Add a dated entry so the shipped chronology does not describe the opposite dependency source; repository policy requires even chores to update the changelog in the same PR.
AGENTS.md reference: AGENTS.md:L94-L96
Useful? React with 👍 / 👎.
Mesa DescriptionTL;DRReplaces the broken What changed?
Description generated by Mesa. Update settings |
… document why this cannot merge A cold install from the lockfile gates (and prepares) the fetched repo's ROOT manifest, not the subdirectory package. Approving it lets install exit 0 — but what lands in node_modules/storyproof is the repository root (storyproof-monorepo), not the packed packages/storyproof: pnpm's install-from-lockfile path ignores the '&path:' qualifier. Reproduced with fresh stores on pnpm 10.34.4 and 11.16.0 (the 11.7 fix kept the path in the lockfile but not in this fetch path); only pnpm 10's warm full-resolution install produced the correct package. git+path: dependencies therefore cannot pass this repo's frozen-lockfile CI, and this PR stays a documented negative result until a working storyproof version is on the registry. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
Verdict: negative result — do not merge. The git-based dependency mechanism works in principle (pnpm packs the git dep,
Branch stays as a minimal repro (worth filing upstream against pnpm). The path forward for this repo is unchanged: a working |
1 participant
Replaces the broken
storyproof@0.0.1-alpha.1registry placeholder inapps/storybookwith a git-hosted dependency on leon0399/storyproof#main(path:packages/storyproof).Why this works
pnpm packs git-hosted dependencies, which runs the package's
prepack(tsdown build) — so the install ships a realdist/built from source, unlike the alpha tarball. Verified end to end from this branch:main(contains this week's panel features)linux-chromium-1280x720@1xThe caveat that keeps this an experiment
pnpm approves git-hosted build scripts only by exact resolved spec (codeload URL + commit sha) in
allowBuilds— bare name,git+httpsrepo URL, and codeload base URL were all tested and none matched, despite pnpm's docs claiming repo-URL form approves any commit. Consequence: every storyproofmaincommit invalidates the allowlist entry and needs re-approval. Pinning the dependency to a sha makes it stable (and reproducible); trackingmainmakes it a recurring chore.Replace with a registry version once a working storyproof release is published past the cooldown — the
minimumReleaseAgeexclusion for it already exists inpnpm-workspace.yaml.Summary by CodeRabbit