Skip to content

Consume storyproof as a git dependency (experiment) #256

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
leon0399 wants to merge 2 commits into
base: master
Choose a base branch
from
Draft

Consume storyproof as a git dependency (experiment) #256

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
bb848be
chore(storybook): consume storyproof as a git dependency (experiment)
leon0399 Jul 30, 2026
0bf7068
chore(storybook): approve the storyproof repo-root manifest too — and…
leon0399 Jul 30, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion apps/storybook/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@
"typecheck": "tsgo --noEmit"
},
"dependencies": {
"storyproof": "0.0.1-alpha.1",
"storyproof": "git+https://github.com/leon0399/storyproof.git#main&path:packages/storyproof",

@chatgpt-codex-connector chatgpt-codex-connector Bot Jul 30, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Record the dependency-source change in the changelog

This switches the shipped dependency from the published npm placeholder to the git-hosted main branch, while the newest relevant CHANGELOG.md entry still explicitly says llame consumes the published storyproof package pinned to 0.0.1-alpha.1. Add a dated entry so the shipped chronology does not describe the opposite dependency source; repository policy requires even chores to update the changelog in the same PR.

AGENTS.md reference: AGENTS.md:L94-L96

Useful? React with 👍 / 👎.

"@workspace/ui": "workspace:*",
"next": "catalog:",
"react": "catalog:",
Expand Down
11 changes: 6 additions & 5 deletions pnpm-lock.yaml
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

14 changes: 14 additions & 0 deletions pnpm-workspace.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -83,6 +83,20 @@ allowBuilds:
# sourcemaps (SENTRY_AUTH_TOKEN set) — flip to true in the deploy pipeline.
"@sentry/cli": false
"@swc/core": false # native bindings ship via platform optionalDependencies
# First-party (github.com/leon0399/storyproof), consumed as a git dependency
# until a working version is on the registry. Git-hosted installs must run
# its prepack (tsdown build) — the repo ships source, dist/ is gitignored.
# Git-hosted packages are approved by repository URL, not name; this form
# covers every commit from the repo, so branch updates don't need
# re-approval.
# Both manifests of the same fetched repo get gated, and which one pnpm
# names depends on the install path: a cold --frozen-lockfile install (CI)
# evaluates the repo ROOT manifest (storyproof-monorepo, whose prepare
# builds the addon), a warm non-frozen install evaluates the subdirectory
# package. Exact resolved specs are the only matcher pnpm accepts for
# git-hosted packages, so both entries move on every storyproof commit.
"storyproof@https://codeload.github.com/leon0399/storyproof/tar.gz/95615e78bf6bdaca98b2fd5ba5b06d4377ee1319#path:packages/storyproof": true
Comment on lines +89 to +98

@coderabbitai coderabbitai Bot Jul 30, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win

Correct the re-approval comment.

This allowBuilds entry is pinned to commit 95615e78bf6bdaca98b2fd5ba5b06d4377ee1319, so a new main commit will resolve to a different codeload URL and require a new approval. Update the comment to describe the SHA-specific behavior; otherwise maintainers may expect branch updates to install without changing allowBuilds.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@pnpm-workspace.yaml` around lines 89 - 92, Update the comment above the
storyproof allowBuilds entry to state that it is pinned to a specific commit SHA
and that changes resolving to a different codeload URL require renewed approval;
do not claim that branch updates are covered automatically.

@chatgpt-codex-connector chatgpt-codex-connector Bot Jul 30, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Reapprove each resolved storyproof commit

When main advances and the lockfile is refreshed, pnpm identifies this git build by the newly resolved codeload URL and commit SHA, but this allowlist key hardcodes 95615e…. The new package will therefore have its required prepack blocked and, because dist/ is gitignored, Storybook will receive an unusable package. The adjacent claim that branch updates need no reapproval is the opposite of the exact-SHA behavior; either pin the dependency to this SHA or update the approval whenever it resolves to another commit.

Useful? React with 👍 / 👎.

"storyproof-monorepo@https://codeload.github.com/leon0399/storyproof/tar.gz/95615e78bf6bdaca98b2fd5ba5b06d4377ee1319": true
core-js-pure: false # funding banner
lefthook: false # binary ships via platform optionalDependencies; prepare script syncs hooks
sharp: false # native bindings ship via platform optionalDependencies
Expand Down
Loading