Uh oh!
There was an error while loading. Please reload this page.
ci + publish: GitHub Actions, package.json fields, lockfile - #3
Conversation
Runs the mocha suite on every push to master and every PR against master, across Node 20 and 22 (current active LTS). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Aligns meaco's package.json with the org template (cf. jarvis-emitter) and adds the publish-hygiene fields it was missing: - license: "MIT" — matches the existing LICENSE file - files whitelist — ships only index.js, README.md, LICENSE (no test/, .github/, etc.); verified with `npm publish --dry-run`: 4 files, 1.9 kB tarball, 3.7 kB unpacked - engines.node: ">=18" — matches the CI matrix; older Node refuses to install rather than installing-and-failing-mysteriously - prepublishOnly: "npm test" — every `npm publish` runs the mocha suite first; a red test blocks the publish - homepage — points to the README on GitHub - repository.url normalized to "git+https://..." form Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Reproducible installs for developers and CI, enables `npm ci` (stricter than `npm install` — fails on lockfile/package.json drift) and the `cache: npm` step in GitHub Actions. No effect on consumers — npm ignores transitive lockfiles. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
There was a problem hiding this comment.
Pull request overview
Tightens package.json for publish hygiene (adds license, files, engines.node, prepublishOnly, homepage, canonicalizes repository.url) and commits a package-lock.json for reproducible installs. The diff also includes a new .github/workflows/ci.yml, which the PR description attributes to a separate follow-up PR.
Changes:
- Add publish-hygiene fields to
package.json(license, files, engines, prepublishOnly, homepage) and canonicalize repo URL. - Commit
package-lock.json(lockfileVersion 2) for reproducible installs. - Add a GitHub Actions CI workflow running mocha on Node 18/20/22.
Reviewed changes
Copilot reviewed 2 out of 3 changed files in this pull request and generated 3 comments.
| File | Description |
|---|---|
| package.json | Adds license/files/engines/prepublishOnly/homepage and canonical repository URL. |
| package-lock.json | New lockfile pinning all transitive dependencies. |
| .github/workflows/ci.yml | New CI workflow for push/PR on master across Node 18/20/22. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
Modeled on the jarvis-emitter workflow: PR-triggered, Node 18.x/20.x/22.x matrix, `npm ci` against the committed lockfile, `cache: npm` for fast installs. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Per PR review (Copilot on package.json:25): the pinned mocha@4.1.0 (2017) pulled in deprecated transitives (glob@7, inflight, mkdirp@0) and a vulnerable minimist@0.0.8 (CVE-2020-7598, prototype pollution). - chai: ^4.1.2 -> ^4.5.0 (latest 4.x; stays CJS — chai 5 is ESM-only) - mocha: ^4.0.1 -> ~11.7.5 (matches jarvis-emitter template) - overrides: force-bump mocha's vulnerable transitives: - diff -> ^8.0.3 (fixes GHSA-73rr-hh4g-fpgx DoS) - serialize-javascript -> ^7.0.3 (fixes GHSA-5c6j-r48x-rmvq RCE, CVSS 8.1) `npm audit` now reports 0 vulnerabilities. Test suite still 9/9 green. These are dev-only dependencies — meaco's published tarball remains 4 files (index.js, README.md, LICENSE, package.json), unchanged. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Uh oh!
There was an error while loading. Please reload this page.
| "LICENSE" | ||
| ], | ||
| "engines": { | ||
| "node": ">=18" |
There was a problem hiding this comment.
engines floor with a minor version bump — quick consumer audit?
engines.node: ">=18" is new in this PR; pairing it with a minor 2.0.0 → 2.1.0 bump means any consumer still on Node <18 with engines-strict=true (or npm install --engine-strict) will see installs of 2.1.0fail rather than warn. Strict semver would say a new engines floor is a major bump.
Could you check whether anything in MCE still consumes meaco on Node <18? Likely all our consumers are already on ≥18, but I'd rather confirm than assume. If everything's on ≥18 we can accept the deviation and merge as-is — just leave a note here. If anything older turns up, cleanest fix is 3.0.0.
Resolve this thread if there shouldn't be any consumer on Node <18.
Summary
Combines CI setup, publish-readiness improvements, and a dev-dep refresh into one PR. Modeled on the jarvis-emitter template.
1. CI — `.github/workflows/ci.yml`
2. package.json hygiene
3. Lockfile
Adds `package-lock.json` for reproducible installs and to enable `npm ci` + `cache: npm` in CI. No effect on consumers — npm ignores transitive lockfiles.
4. Dev-dep refresh (per Copilot review on `package.json:25`)
The previously pinned `mocha@4.1.0` (2017) pulled in deprecated transitives (`glob@7`, `inflight`, `mkdirp@0`) and `minimist@0.0.8` (CVE-2020-7598, prototype pollution).
`overrides` force-bumps mocha 11.7.x's remaining vulnerable transitives:
`npm audit` is now 0 vulnerabilities. Test suite is 9/9 green on the new toolchain.
These are dev-only deps — they don't ship to consumers (see dry-run below).
Verified with `npm publish --dry-run`
```
📦 meaco@2.1.0
=== Tarball Contents ===
1.1kB LICENSE
76B README.md
1.9kB index.js
740B package.json
package size: 1.9 kB
unpacked size: 3.8 kB
total files: 4
```
No `test/`, no `.github/`, no `package-lock.json`, no `node_modules` in the published tarball. `prepublishOnly` ran the mocha suite before the dry-publish.
Not included (deliberately)
Test plan