Skip to content

Commit 0f0a211

Browse files
fengmk2fengmk2
committed
test(snapshots): redact scaffolded devEngines version pins
vp create/migrate write the resolved runtime and package-manager version into a scaffolded package.json devEngines block, so recorded snapshots go stale whenever the package manager or Node publishes a release (yarn 4.17.0 -> 4.17.1 broke the create_approve_builds_yarn case). Mask the version value adjacent to a devEngines tool-name key (node/npm/pnpm/yarn/bun/deno), the same way the banner already masks "yarn <version>", and normalize the 9 existing pins across 5 snapshots. User-controlled semver in the same manifests (core-js, a pre-existing packageManager string, top-level version) stays verbatim.
1 parent 5ebe64e commit 0f0a211

7 files changed

Lines changed: 74 additions & 9 deletions

File tree

‎crates/vite_cli_snapshots/tests/cli_snapshots/fixtures/create_approve_builds_bun/snapshots/create_approve_builds_bun.md‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,7 @@ core-js recorded under trustedDependencies
3636
"devEngines": {
3737
"packageManager": {
3838
"name": "bun",
39-
"version": "1.3.14",
39+
"version": "<version>",
4040
"onFail": "download"
4141
}
4242
},
@@ -86,7 +86,7 @@ no trustedDependencies, the build was not run
8686
"devEngines": {
8787
"packageManager": {
8888
"name": "bun",
89-
"version": "1.3.14",
89+
"version": "<version>",
9090
"onFail": "download"
9191
}
9292
}
@@ -131,7 +131,7 @@ core-js is now recorded under trustedDependencies
131131
"devEngines": {
132132
"packageManager": {
133133
"name": "bun",
134-
"version": "1.3.14",
134+
"version": "<version>",
135135
"onFail": "download"
136136
}
137137
},

‎crates/vite_cli_snapshots/tests/cli_snapshots/fixtures/create_approve_builds_yarn/snapshots/create_approve_builds_yarn.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -40,7 +40,7 @@ core-js recorded under dependenciesMeta.built
4040
"devEngines": {
4141
"packageManager": {
4242
"name": "yarn",
43-
"version": "4.17.0",
43+
"version": "<version>",
4444
"onFail": "download"
4545
}
4646
}
@@ -86,7 +86,7 @@ no dependenciesMeta, the build was not run
8686
"devEngines": {
8787
"packageManager": {
8888
"name": "yarn",
89-
"version": "4.17.0",
89+
"version": "<version>",
9090
"onFail": "download"
9191
}
9292
}

‎crates/vite_cli_snapshots/tests/cli_snapshots/fixtures/create_org_bundled/snapshots/create_org_bundled.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@ verify package.json name was rewritten
2929
"devEngines": {
3030
"packageManager": {
3131
"name": "pnpm",
32-
"version": "11.10.0",
32+
"version": "<version>",
3333
"onFail": "download"
3434
}
3535
}

‎crates/vite_cli_snapshots/tests/cli_snapshots/fixtures/new_vite_monorepo/snapshots/new_vite_monorepo.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,7 @@ check package.json
4242
"devEngines": {
4343
"packageManager": {
4444
"name": "pnpm",
45-
"version": "11.10.0",
45+
"version": "<version>",
4646
"onFail": "download"
4747
}
4848
},
@@ -422,7 +422,7 @@ check package.json
422422
"devEngines": {
423423
"packageManager": {
424424
"name": "pnpm",
425-
"version": "11.10.0",
425+
"version": "<version>",
426426
"onFail": "download"
427427
}
428428
},

‎crates/vite_cli_snapshots/tests/cli_snapshots/fixtures/new_vite_monorepo_bun/snapshots/new_vite_monorepo_bun.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -49,7 +49,7 @@ check package.json with catalog
4949
"devEngines": {
5050
"packageManager": {
5151
"name": "bun",
52-
"version": "1.3.14",
52+
"version": "<version>",
5353
"onFail": "download"
5454
}
5555
},

‎crates/vite_cli_snapshots/tests/cli_snapshots/redact.rs‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -47,6 +47,22 @@ static VP_VERSION_RE: LazyLock<regex::Regex> = LazyLock::new(|| {
4747
)
4848
.unwrap()
4949
});
50+
// `vp create`/`vp migrate` pin the exact resolved runtime and package-manager
51+
// version into a scaffolded manifest's `devEngines` block (`{ "name": "yarn",
52+
// "version": "4.17.0", ... }`, likewise pnpm/bun/node). Those track whatever
53+
// the package manager or Node published most recently, so they churn on every
54+
// upstream release exactly like the banner's `yarn <version>` line (already
55+
// masked). Mask by the adjacent `"name"` context so a scaffolded pin is
56+
// redacted while user-controlled semver in the same manifest (`"core-js":
57+
// "3.39.0"`, a pre-existing `"packageManager": "bun@1.3.11"` input) stays
58+
// assertable. The tool-name allowlist keeps ordinary top-level `"name":
59+
// "my-app"` / `"version": "0.0.0"` pairs verbatim.
60+
static DEV_ENGINES_VERSION_RE: LazyLock<regex::Regex> = LazyLock::new(|| {
61+
regex::Regex::new(
62+
r#"("name":\s*"(?:node|npm|pnpm|yarn|bun|deno)",\s*"version":\s*")\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?"#,
63+
)
64+
.unwrap()
65+
});
5066
// Output bytes differ across OSes (line endings, embedded paths), so byte
5167
// sizes and content-derived asset hashes can never be part of a shared
5268
// snapshot. The unit is kept ("<size> kB"): it only changes when content
@@ -177,6 +193,10 @@ pub fn redact_output(
177193
// (see VP_VERSION_RE), which bumps on every release.
178194
output = VP_VERSION_RE.replace_all(&output, "${1}<version>").into_owned();
179195

196+
// Redact scaffolded devEngines runtime/package-manager pins by name
197+
// context (see DEV_ENGINES_VERSION_RE), which track upstream releases.
198+
output = DEV_ENGINES_VERSION_RE.replace_all(&output, "${1}<version>").into_owned();
199+
180200
// Redact thread counts like "16 threads" to "<n> threads"
181201
output = THREAD_RE.replace_all(&output, "<n> threads").into_owned();
182202

‎crates/vite_cli_snapshots/tests/redact_unit.rs‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -82,6 +82,51 @@ fn masks_vite_plus_version_by_context_only() {
8282
);
8383
}
8484

85+
#[test]
86+
fn masks_scaffolded_dev_engines_pins_by_name_context() {
87+
// vp create/migrate pin the resolved runtime and package-manager version
88+
// into devEngines; both churn on upstream releases and must be masked,
89+
// while user-controlled semver in the same manifest stays verbatim.
90+
let input = concat!(
91+
" \"devEngines\": {\n",
92+
" \"packageManager\": {\n",
93+
" \"name\": \"yarn\",\n",
94+
" \"version\": \"4.17.0\",\n",
95+
" \"onFail\": \"download\"\n",
96+
" },\n",
97+
" \"runtime\": {\n",
98+
" \"name\": \"node\",\n",
99+
" \"version\": \"24.18.0\"\n",
100+
" }\n",
101+
" },\n",
102+
" \"name\": \"approved-app\",\n",
103+
" \"version\": \"0.0.0\",\n",
104+
" \"packageManager\": \"bun@1.3.11\",\n",
105+
" \"core-js\": \"3.39.0\"\n",
106+
)
107+
.to_owned();
108+
assert_eq!(
109+
redact_output(input, &[], true),
110+
concat!(
111+
" \"devEngines\": {\n",
112+
" \"packageManager\": {\n",
113+
" \"name\": \"yarn\",\n",
114+
" \"version\": \"<version>\",\n",
115+
" \"onFail\": \"download\"\n",
116+
" },\n",
117+
" \"runtime\": {\n",
118+
" \"name\": \"node\",\n",
119+
" \"version\": \"<version>\"\n",
120+
" }\n",
121+
" },\n",
122+
" \"name\": \"approved-app\",\n",
123+
" \"version\": \"0.0.0\",\n",
124+
" \"packageManager\": \"bun@1.3.11\",\n",
125+
" \"core-js\": \"3.39.0\"\n",
126+
)
127+
);
128+
}
129+
85130
#[test]
86131
fn replaces_paths_with_labels() {
87132
let input = "built /tmp/stage-1/dist in 3ms\n".to_owned();

0 commit comments

Comments
 (0)