fix(templates): move the generator dependency ranges with today's dependabot wave - #4969
Closed
yinlianghui wants to merge 2 commits into
Closed
fix(templates): move the generator dependency ranges with today's dependabot wave#4969yinlianghui wants to merge 2 commits into
yinlianghui wants to merge 2 commits into
Conversation
The routed temp app's generated manifest declared lucide-react at ^1.29.0 while all 22 sibling manifests that declare it had moved to ^1.31.0, so a generated app asked npm for an icon library older than the one every @object-ui/* package it installs alongside was built against. app-generator.test.ts derives its expectation from the in-repo range, so the drift was caught -- both pins were red. They just went red too late to stop anything: the dependency PR merged while those shards were still running, and the failure then surfaced on the merge ref of every unrelated open PR. The other 12 anchored ranges were swept against the same dependabot batch and are all in sync. Deriving the value rather than quoting it was considered and rejected; the reasoning is recorded at the call site. Fixes #4968 Co-authored-by: Claude <noreply@anthropic.com>
Contributor
✅ Console Performance Budget
📦 Bundle Size Report
Size Limits
|
…pendabot wave The scaffolded plugin's generated devDependencies declared @testing-library/jest-dom at ^7.0.0 while the repo root had moved to ^7.0.1 (#4948's dev-dependencies group), so templates.test.ts's anchor rule was red on main independently of the lucide-react drift in the previous commit. Same defect class, same wave, and the same pairing the previous occurrence of this incident was fixed as (#4098 / PR #4099 moved these two templates in one PR). Found only by sweeping the class rather than the package: the anchor rule throws on its first mismatch, so this second template reported nothing until the first was green. The doc table above the map is moved with it -- it states each anchored range, so leaving it would just relocate the fossil into a comment. Co-authored-by: Claude <noreply@anthropic.com>
Contributor
✅ Console Performance Budget
📦 Bundle Size Report
Size Limits
|
Collaborator
Author
范围外发现(已立卡,均 unassigned)
两条都是 CI / 门自身的问题,不该搭在一个全仓阻断的热修上。 给 PM 的验收提示本 PR 是 draft,未 undraft,等加急验收。 一个必须知道的点:本 PR 的 base 是 Generated by Claude Code |
This was referenced Aug 17, 2026
yinlianghui
pushed a commit
that referenced
this pull request
Aug 17, 2026
…e-4977-ga-pin-residue PM queue surgery: the two hot-fix PRs (#4969, #4978) each red on the other's signatures, so neither could enter the merge queue alone. This merge makes PR #4978 carry all three main-side fixes and go green solo, per the sequencing note in PR #4978's body. Fixes #4968 rides with it. Co-Authored-By: Claude <noreply@anthropic.com>
Collaborator
Author
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #4968
改了什么
两个生成器模板的第三方区间跟到 workspace 现值,各一行 + 各一个 changeset:
@object-ui/clisrc/utils/app-generator.tslucide-react^1.29.0→^1.31.0c1454a2d9)@object-ui/create-pluginsrc/templates.ts@testing-library/jest-dom^7.0.0→^7.0.1590dd6356)修法选择:字面量,不派生(逐条说明为何)
钉的注释自述「A literal here is the very fossil generator this file exists to stop」,所以我先认真评估了派生路线,结论是不派生。理由是实测的,不是偏好:
拿不到 manifest。 派生要读
@object-ui/components的 manifest(lucide 是它的dependencies,且 cli 确实依赖它)。实测两种 specifier 都不通:前者是 exports map 只有
.和./style.css的必然结果 —— 要走通就得给另一个已发布包的公开 exports 面加./package.json,已越出本卡包边界;后者只在 build 之后才 resolve,且落到dist/,拿 manifest 仍要目录上溯。它只能治 13 个里的 1 个。 cli 侧锚表
DEPENDENCY_ANCHORS有 13 个第三方区间,其中 9 个锚到仓库根 manifest,而根 manifest 不随 cli 发布(files: ["dist","README.md","CHANGELOG.md","LICENSE"])—— react / react-dom / react-router-dom / @types/react / @types/react-dom / autoprefixer / tailwindcss / typescript / vite 在运行期没有任何可派生来源。派生给不出全表共享的机制,只能给 lucide 单开一条 bespoke 路径:同类问题还在,还多一份不对称。create-plugin 侧同理(8 个里 6 个锚到根)。锚定纪律本来就是「字面量 + 门」。 objectui#3742 / fix(create-plugin): 把脚手架 build 侧 devDependencies 锚到仓内工具链,并把整张清单钉进 parity 测试 #3754 写得很直白:「quoted rather than invented, so bumping an in-repo manifest and leaving a generator behind fails a test instead of shipping」。
cli-version之所以派生,是因为 fixed 组每次发版都重编号、字面量隔天就腐;第三方区间不是这个节奏,门就是为它设计的机制 —— 这次门也确实响了。修法半衰期,如实声明:一次 bump。 下次 dependabot 动这两个包中任一个,对应钉会以同样方式再红。这不是推测,我实测了(反向验证方向 2)。真正的持久解在本文件上游,见下。
为什么 #4959 自己的 CI 没拦住:门响了,只是响得太晚
这不是检查面漏了,是时序。 #4959 自己的 head SHA
31745d8b上,Test shard 1/4 与 3/4 的 conclusion 都是failure,报的就是本卡引用的那两条断言(job 95325241579 日志):时间线是决定性的:
github-actions[bot]合入 maindependabot-auto-merge.yml对 semver-patch/minor 无条件执行gh pr merge --auto --squash(1.29.0 到 1.31.0 是 minor,命中)。--auto在 required check 集满足的那一刻就落,而承载这个门的 4 分片 test 矩阵是整个 workflow 里最慢的 job(本次import 986.93s,单片约 9 分钟),因此系统性地最后报到、最容易被 auto-merge 跑过去。仓库 AGENTS.md 恰好禁止 agent 用--auto,理由一字不差就是这个;而dependabot-auto-merge.yml仍在用。这是任何红都能落到 main 的通道,不限于区间漂移,所以我单独立卡而没在本 PR 改 CI。这是一周内的第二次复发
#4098(8-10)是同一条测试、同一个依赖:
lucide-react1.28.0 → 1.29.0 打断同一个 ratchet,由 PR #4099 以同样的字面量跟进修掉。#4098 当时就写下了持久问题:那个问题没有落地,七天后同一处以同样方式再红。#4098 也已经观察到「only the first mismatch in each file is reported」—— 同样没落地,而这正是下面第二处同症一周后仍能藏住的原因。
扫出第二处同症:
packages/create-plugin(本 PR 一并修)#4099 的处理方式是一个 PR 修两个模板(标题即 "move generator dependency ranges with the dependabot wave"),我按同一先例做:
packages/create-plugin/src/__tests__/templates.test.ts:356在main上当前就是红的,与 lucide 无关:来自 #4948 的 dev-dependencies 组 bump(
590dd6356)。只修 #4968 不能让全仓转绿,受阻 PR 的 shard 仍会红,auto-merge 队列仍然堵着 —— 所以一并修。顺带一条方法学教训:这处是按缺陷类别扫才发现的,不是按包扫。锚规则逐名
expect、首个不匹配即抛,所以第一个模板绿之前,第二个模板什么都不报。我用 grep 把这一类 ratchet 全量枚举了一遍,全仓只有这两个测试文件带它(app-generator.test.ts与templates.test.ts),两个都已在本 PR 内。两个模板的全量区间核对:各只有一处漂
因为门只报第一处,下面两张表是我另写脚本全量算的,不是测试报的。
@object-ui/cli—DEPENDENCY_ANCHORS13 项:@object-ui/create-plugin—DEV_DEPENDENCY_ANCHORS8 项:本批次点名的另外两个包与模板零交集:
@sentry/react(#4957) 与maplibre-gl(#4956) 在packages/cli/src与packages/create-plugin/src里一次都没出现(plugin-report / plugin-map 的依赖);@objectstack/spec|client|formula|lint的 GA bump (#4953/#4954/#4955/#4960) 也都不在两张锚表里。commands/init.ts不自己写任何区间,全部读scaffold-dependencies.ts,第三个生成器无需另改。create-plugin里那张写在注释里的 anchor 表也同步移了一行 —— 它逐条列出每个锚定区间,不动就只是把化石搬进注释。验证
pnpm --workspace-concurrency=2 --filter '@object-ui/cli^...' build→ exit 0pnpm exec vitest run packages/create-plugin/ packages/cli/ --maxWorkers=2→Test Files 6 passed (6) / Tests 138 passed (138)pnpm exec turbo run type-check --concurrency=2→81 successful, 81 total(cli 改动后全量);create-plugin 改动后另跑两包 scoped type-check,均 Donenode scripts/check-control-bytes.mjs→ OK(4436 files);另对本 PR 改动的文件做了越过门盲区的自扫(grep -naP覆盖门不扫的0x01-0x1f),无控制字节no-major/fixed/presence:2 源文件 / 2 changeset)反向验证(每个方向都在跑之前先预判)
方向 1 — 预判「红」: 把 lucide 字面量退回
^1.29.0(workspace 停在^1.31.0),两处钉必须红且与 issue 逐字一致。实测:证明这两处钉读的确实是我改的那个值。jest-dom 同样做了一次,
expected '^7.0.0' to be '^7.0.1'attemplates.test.ts:356:75,1 failed | 18 passed。方向 2 — 预判「反向红」,即半衰期的实测证明: 字面量保持
^1.31.0,把 23 个仓内 manifest 全部改成假值^9.99.0(全部改,因为 dependabot 就是一个 commit 动所有 manifest —— 这也正是 #4959 上仓内一致性依然成立、门能判出值不匹配而不是先撞「in-repo manifests disagree」的原因)。预判:钉以相反方向红。实测:这就是上面「半衰期 = 一次 bump」的证据,而不是一句修辞。三次临时改动全部已回退,工作树只剩本 PR 的四个文件。
不在本 PR 范围内(已另立卡)
见下方 findings 评论。两条都是 CI / 门自身的问题,都是 #4098 一周前就写下、至今未落地的那两条,不该搭在一个全仓阻断的热修上:auto-merge 时序(持久解),与锚规则只报首个不匹配(正是它让第二处模板藏了一周)。