DeepSeek/deepseek-harness
1
0
Fork 0
mirror of https://github.com/deepseek-ai/deepseek-harness synced 2026-08-15 21:04:50 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(landlock-run): close release integration gaps (review round 2)

Browse Source
This commit is contained in:
Hypatia May
2026-08-06 10:52:46 +08:00
parent 598f9719f4
commit d3aa337c26
13 changed files with 46 additions and 37 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
scripts/check-workspace-constraints.ts
View File

@@ -35,6 +35,7 @@ const publicLandlockPackages = new Set([
'node-addon-landlock-run-linux-arm64',
'node-addon-landlock-run-linux-x64',
])
const repositoryUrl = 'git+https://github.com/deepseek-harness/deepseek-harness.git'
const localArtifactDirs = new Set(['node_modules'])
const appPackageFiles: Readonly<Record<string, readonly string[]>> = {
@@ -63,6 +64,7 @@ interface PackageManifest {
>
files?: string[]
publishConfig?: { access?: string }
repository?: { type?: string; url?: string; directory?: string }
peerDependencies?: Record<string, string>
devDependencies?: Record<string, string>
}
@@ -89,12 +91,12 @@ function packageDirs(base: string, depth: number): string[] {
.filter(entry => entry.isDirectory())
.filter(entry => !localArtifactDirs.has(entry.name))
.filter(entry => existsSync(join(root, base, entry.name, 'package.json')))
.map(entry => join(base, entry.name))
.map(entry => `${base}/${entry.name}`)
}
return readdirSync(join(root, base), { withFileTypes: true })
.filter(entry => entry.isDirectory())
.filter(entry => !localArtifactDirs.has(entry.name))
.flatMap(group => packageDirs(join(base, group.name), depth - 1))
.flatMap(group => packageDirs(`${base}/${group.name}`, depth - 1))
}
function workspaceManifests(): WorkspaceManifest[] {
@@ -183,6 +185,12 @@ function checkWorkspace({ dir, manifest }: WorkspaceManifest): string[] {
if (manifest.publishConfig?.access !== 'public') {
errors.push(`${label}: published Landlock package must set publishConfig.access to "public"`)
}
const expectedDirectory = dir
if (manifest.repository?.type !== 'git'
|| manifest.repository.url !== repositoryUrl
|| manifest.repository.directory !== expectedDirectory) {
errors.push(`${label}: published Landlock package repository must use ${repositoryUrl} with directory ${expectedDirectory} for trusted publishing`)
}
} else if (manifest.private !== true) {
errors.push(`${label}: package.json must set "private": true`)
}

8
scripts/gen-third-party-notices.ts
View File

@@ -191,8 +191,8 @@ export function virtualManifest(virtual: string, name: string): VirtualManifest
function installedMetadata(name: string): { license: string; repo: string } {
const override = OVERRIDES[name]
let manifest: (Manifest & { license?: string; repository?: string | { url?: string }; homepage?: string }) | undefined
// The nested Landlock workspace installs into its own store, so a package
// only that workspace depends on is unreachable from the root one.
// Workspace-local link farms can expose a dependency that is not linked at
// the repository root; both are backed by the root workspace's lockfile.
for (const store of ['node_modules', 'native/landlock-run/node_modules']) {
const direct = resolve(root, store, name, 'package.json')
if (existsSync(direct)) {
@@ -208,7 +208,7 @@ function installedMetadata(name: string): { license: string; repo: string } {
const rawRepo = typeof manifest?.repository === 'string' ? manifest.repository : manifest?.repository?.url ?? manifest?.homepage
const repo = override?.repo ?? normalizeRepo(rawRepo)
if (license === undefined || repo === undefined) {
throw new Error(`gen-third-party-notices: cannot resolve ${license === undefined ? 'license' : 'repository'} for ${name}; run \`pnpm install\` (or, for a Landlock-only dependency, \`pnpm --dir native/landlock-run install\`), or add an OVERRIDES entry.`)
throw new Error(`gen-third-party-notices: cannot resolve ${license === undefined ? 'license' : 'repository'} for ${name}; run \`pnpm install\`, or add an OVERRIDES entry.`)
}
return { license, repo }
}
@@ -544,7 +544,7 @@ DeepSeek Harness is licensed under [BSD 3-Clause](LICENSE). It depends on the th
This file lists **direct** dependencies declared by the workspace. It is generated from the workspace manifests by \`scripts/gen-third-party-notices.ts\`: a pre-commit hook regenerates it whenever a staged file changes one of its inputs, and \`scripts/gen-third-party-notices.spec.ts\` asserts in the test lane that the committed bytes match. Deleting a manifest runs no hook, so that case is caught by the assertion instead. Run \`pnpm run verify-third-party-notices\` for the standalone check.
The complete npm transitive closure, with exact pinned versions, is recorded in [\`pnpm-lock.yaml\`](pnpm-lock.yaml) — inspect it with \`pnpm licenses list\`. The Python closure is recorded in [\`python/sdk/uv.lock\`](python/sdk/uv.lock), and the Landlock launcher workspace keeps its own in [\`native/landlock-run/pnpm-lock.yaml\`](native/landlock-run/pnpm-lock.yaml).
The complete npm transitive closure, including the Landlock launcher workspace, is recorded with exact pinned versions in [\`pnpm-lock.yaml\`](pnpm-lock.yaml) — inspect it with \`pnpm licenses list\`. The Python closure is recorded separately in [\`python/sdk/uv.lock\`](python/sdk/uv.lock).
## Vendored source (\`vendor/\`)