From bb848beaf41c5d1bed46bf1bb917eb08bb7758bc Mon Sep 17 00:00:00 2001 From: Leonid Meleshin Date: Thu, 30 Jul 2026 08:29:28 +0200 Subject: [PATCH 1/2] chore(storybook): consume storyproof as a git dependency (experiment) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Replace the broken 0.0.1-alpha.1 registry placeholder with a git-hosted dependency on github.com/leon0399/storyproof#main (path:packages/storyproof). pnpm packs git-hosted deps, which runs the package's prepack (tsdown build), so the install ships a real dist/ built from source — verified by booting Storybook and running the full visual suite: 246 stories captured (196 new, 50 disabled-passed) under linux-chromium-1280x720@1x. Caveat that keeps this an experiment: pnpm approves git-hosted build scripts only by exact resolved spec (codeload URL + commit sha), so the allowBuilds entry must be re-approved on every storyproof main commit — neither the name, the git+https repo URL, nor the codeload base URL matched. Replace with a registry version once one is published past the cooldown. Co-Authored-By: Claude Fable 5 --- apps/storybook/package.json | 2 +- pnpm-lock.yaml | 11 ++++++----- pnpm-workspace.yaml | 7 +++++++ 3 files changed, 14 insertions(+), 6 deletions(-) diff --git a/apps/storybook/package.json b/apps/storybook/package.json index 3be37566..6c095fd7 100644 --- a/apps/storybook/package.json +++ b/apps/storybook/package.json @@ -14,7 +14,7 @@ "typecheck": "tsgo --noEmit" }, "dependencies": { - "storyproof": "0.0.1-alpha.1", + "storyproof": "git+https://github.com/leon0399/storyproof.git#main&path:packages/storyproof", "@workspace/ui": "workspace:*", "next": "catalog:", "react": "catalog:", diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 8d74edf9..c292f005 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -283,8 +283,8 @@ importers: specifier: 'catalog:' version: 19.2.7(react@19.2.7) storyproof: - specifier: 0.0.1-alpha.1 - version: 0.0.1-alpha.1(react@19.2.7)(storybook@10.5.0(@types/react@19.0.10)(prettier@3.5.1)(react@19.2.7)) + specifier: git+https://github.com/leon0399/storyproof.git#main&path:packages/storyproof + version: https://codeload.github.com/leon0399/storyproof/tar.gz/95615e78bf6bdaca98b2fd5ba5b06d4377ee1319#path:packages/storyproof(react@19.2.7)(storybook@10.5.0(@types/react@19.0.10)(prettier@3.5.1)(react@19.2.7)) devDependencies: '@base-ui/react': specifier: ^1.6.0 @@ -7834,8 +7834,9 @@ packages: vite-plus: optional: true - storyproof@0.0.1-alpha.1: - resolution: {integrity: sha512-gKe8cplAaMS86Z/dWBtx9KgcjqfBIn5LGvCWAD8XqozWZd9kz179HHnbku/n7UD/wv6BxWMRX8dVdgwe0JpRDw==} + storyproof@https://codeload.github.com/leon0399/storyproof/tar.gz/95615e78bf6bdaca98b2fd5ba5b06d4377ee1319#path:packages/storyproof: + resolution: {gitHosted: true, integrity: sha512-PXqqIY6sS8dv3iO3J2WCRIjdD4R2ip0LkkZquRBhJ3SHxEFnin4tW4LtVn/LkXe+eNGT+j3h6b47/lPzgHQrCw==, tarball: https://codeload.github.com/leon0399/storyproof/tar.gz/95615e78bf6bdaca98b2fd5ba5b06d4377ee1319} + version: 0.0.1-alpha.1 engines: {node: '>=22.12'} peerDependencies: react: ^19.0.0 @@ -16291,7 +16292,7 @@ snapshots: - react - utf-8-validate - storyproof@0.0.1-alpha.1(react@19.2.7)(storybook@10.5.0(@types/react@19.0.10)(prettier@3.5.1)(react@19.2.7)): + storyproof@https://codeload.github.com/leon0399/storyproof/tar.gz/95615e78bf6bdaca98b2fd5ba5b06d4377ee1319#path:packages/storyproof(react@19.2.7)(storybook@10.5.0(@types/react@19.0.10)(prettier@3.5.1)(react@19.2.7)): dependencies: '@storybook/icons': 2.1.0(react@19.2.7) pixelmatch: 7.2.0 diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index b15d0104..ab48a934 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -83,6 +83,13 @@ allowBuilds: # sourcemaps (SENTRY_AUTH_TOKEN set) — flip to true in the deploy pipeline. "@sentry/cli": false "@swc/core": false # native bindings ship via platform optionalDependencies + # First-party (github.com/leon0399/storyproof), consumed as a git dependency + # until a working version is on the registry. Git-hosted installs must run + # its prepack (tsdown build) — the repo ships source, dist/ is gitignored. + # Git-hosted packages are approved by repository URL, not name; this form + # covers every commit from the repo, so branch updates don't need + # re-approval. + "storyproof@https://codeload.github.com/leon0399/storyproof/tar.gz/95615e78bf6bdaca98b2fd5ba5b06d4377ee1319#path:packages/storyproof": true core-js-pure: false # funding banner lefthook: false # binary ships via platform optionalDependencies; prepare script syncs hooks sharp: false # native bindings ship via platform optionalDependencies From 0bf7068fa842f7478203fed81ca6f556fc567594 Mon Sep 17 00:00:00 2001 From: Leonid Meleshin Date: Thu, 30 Jul 2026 10:02:06 +0200 Subject: [PATCH 2/2] =?UTF-8?q?chore(storybook):=20approve=20the=20storypr?= =?UTF-8?q?oof=20repo-root=20manifest=20too=20=E2=80=94=20and=20document?= =?UTF-8?q?=20why=20this=20cannot=20merge?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit A cold install from the lockfile gates (and prepares) the fetched repo's ROOT manifest, not the subdirectory package. Approving it lets install exit 0 — but what lands in node_modules/storyproof is the repository root (storyproof-monorepo), not the packed packages/storyproof: pnpm's install-from-lockfile path ignores the '&path:' qualifier. Reproduced with fresh stores on pnpm 10.34.4 and 11.16.0 (the 11.7 fix kept the path in the lockfile but not in this fetch path); only pnpm 10's warm full-resolution install produced the correct package. git+path: dependencies therefore cannot pass this repo's frozen-lockfile CI, and this PR stays a documented negative result until a working storyproof version is on the registry. Co-Authored-By: Claude Fable 5 --- pnpm-workspace.yaml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index ab48a934..da23c82e 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -89,7 +89,14 @@ allowBuilds: # Git-hosted packages are approved by repository URL, not name; this form # covers every commit from the repo, so branch updates don't need # re-approval. + # Both manifests of the same fetched repo get gated, and which one pnpm + # names depends on the install path: a cold --frozen-lockfile install (CI) + # evaluates the repo ROOT manifest (storyproof-monorepo, whose prepare + # builds the addon), a warm non-frozen install evaluates the subdirectory + # package. Exact resolved specs are the only matcher pnpm accepts for + # git-hosted packages, so both entries move on every storyproof commit. "storyproof@https://codeload.github.com/leon0399/storyproof/tar.gz/95615e78bf6bdaca98b2fd5ba5b06d4377ee1319#path:packages/storyproof": true + "storyproof-monorepo@https://codeload.github.com/leon0399/storyproof/tar.gz/95615e78bf6bdaca98b2fd5ba5b06d4377ee1319": true core-js-pure: false # funding banner lefthook: false # binary ships via platform optionalDependencies; prepare script syncs hooks sharp: false # native bindings ship via platform optionalDependencies