refactor: switch to packumeta for trust levels#2804
Conversation
This switches our trust level logic to use the new `packumeta` package, so we can share the same scale as other tools in the space (e.g. e18e tools already use this). Once staging signals are added to npm, this package will be updated to expose them as the existing `stagedPublish` level. NOTE: This does not fix the current problem of staged packages showing up as a "downgrade".
|
The latest updates on your projects. Learn more about Vercel for GitHub.
2 Skipped Deployments
|
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
📝 WalkthroughSummary by CodeRabbit
WalkthroughThis PR migrates trust metadata handling from a legacy hasProvenance/trustLevel model to packumeta's TrustStatus across types, composables, utilities, components and tests. ChangesTrust Status Migration to packumeta
Suggested reviewers
🚥 Pre-merge checks | ✅ 4✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
e18e dependency analysisNo dependency warnings found. |
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (1)
test/nuxt/components/Package/Versions.spec.ts (1)
16-30: ⚡ Quick winAlign the fixture helper with the migrated
trustStatuscontract.
createVersionstill uses legacyhasProvenanceand can omittrustStatusentirely, which makes fixtures drift from the new schema and weakens contract coverage.[recommendation]
♻️ Proposed refactor
function createVersion( version: string, options: { deprecated?: string - hasProvenance?: boolean + trustStatus?: SlimVersion['trustStatus'] } = {}, ): SlimVersion { return { version, deprecated: options.deprecated, tags: undefined, - ...(options.hasProvenance - ? { trustStatus: { provenance: true, trustedPublisher: false, stagedPublish: false } } - : {}), + trustStatus: options.trustStatus ?? { + provenance: false, + trustedPublisher: false, + stagedPublish: false, + }, } as SlimVersion }As per coding guidelines: Ensure you write strictly type-safe code.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@test/nuxt/components/Package/Versions.spec.ts` around lines 16 - 30, The fixture helper createVersion currently uses the legacy hasProvenance boolean and sometimes omits trustStatus, drifting from the migrated trustStatus contract; update createVersion to accept an explicit trustStatus parameter (e.g., trustStatus?: { provenance: boolean; trustedPublisher: boolean; stagedPublish: boolean } or the project's TrustStatus type) and always include a properly typed trustStatus property in the returned SlimVersion, removing hasProvenance and ensuring the return value is strictly type-safe and conforms to SlimVersion's new schema.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@test/nuxt/components/Package/Versions.spec.ts`:
- Around line 16-30: The fixture helper createVersion currently uses the legacy
hasProvenance boolean and sometimes omits trustStatus, drifting from the
migrated trustStatus contract; update createVersion to accept an explicit
trustStatus parameter (e.g., trustStatus?: { provenance: boolean;
trustedPublisher: boolean; stagedPublish: boolean } or the project's TrustStatus
type) and always include a properly typed trustStatus property in the returned
SlimVersion, removing hasProvenance and ensuring the return value is strictly
type-safe and conforms to SlimVersion's new schema.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 0df840f6-7bfe-44b6-9759-28eefc5a7148
📒 Files selected for processing (1)
test/nuxt/components/Package/Versions.spec.ts
|
maybe not a |
43081j
changed the title
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
|
this now actually fixes the trust scale problem too - through a terrible but working hack... basically, we now detect something as having used staging if @serhalp its a true hack but im happy with it if you are, and it'll fix the false downgrade errors people are seeing in the timeline. once npm expose a real signal, we can update the library EDIT: npm are now going to ship the fix, so im going to merge this and do a follow up once they have. |
2 participants
🔗 Linked issue
N/A
🧭 Context
Unifying trust level scales across ecosystem tools.
📚 Description
This switches our trust level logic to use the new
packumetapackage,so we can share the same scale as other tools in the space (e.g. e18e
tools already use this).
Once staging signals are added to npm, this package will be updated to
expose them as the existing
stagedPublishlevel.NOTE: This does not fix the current problem of staged packages showing
up as a "downgrade".