yarn: fix lockfile order and bundle Yarn 3.6.2 for offline builds #5
yarn: fix lockfile order and bundle Yarn 3.6.2 for offline builds #5derasdf wants to merge 1 commit intohermetoproject:yarn-basicfrom
Conversation
Summary of ChangesHello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request addresses issues with Yarn's lockfile order and ensures that container builds can be hermetic by bundling the Yarn binary. The changes aim to resolve problems where the example yarn test from hermeto would fail, and to improve the reliability of builds in environments without network access. Highlights
🧠 New Feature in Public Preview: You can now enable Memory to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console. Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here. Footnotes
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates the Yarn configuration to enable hermetic builds by bundling a specific Yarn version and fixing the lockfile order. The changes in .yarnrc.yml and yarn.lock look good and align with the goal of creating reproducible, offline builds. However, I have a couple of suggestions for the Containerfile to improve its maintainability. Specifically, I recommend adding a comment to clarify the purpose of the sourced /tmp/hermeto.env file and restoring the final newline character, which is a standard convention for text files.
| WORKDIR /src | ||
|
|
||
| RUN yarn install | ||
| RUN . /tmp/hermeto.env && yarn install |
There was a problem hiding this comment.
This RUN command sources an environment file /tmp/hermeto.env without any context. This makes the Containerfile difficult to understand and maintain as it introduces an implicit dependency. To improve clarity, please add a comment explaining what this file is for and where it comes from.
# Source environment variables from hermeto for the build
RUN . /tmp/hermeto.env && yarn install
Reorder the workspace entry in yarn.lock to match Yarn's expected alphabetical order and bundle the Yarn 3.6.2 binary under .yarn/releases/ so hermetic container builds do not require network access to download it via Corepack. Signed-off-by: Vladimir Aleksandrov <valeksan@redhat.com>
1 participant
Reorder the workspace entry in yarn.lock to match Yarn's expected alphabetical order and bundle the Yarn 3.6.2 binary under .yarn/releases/ so hermetic container builds do not require network access to download it via Corepack.
Not fully sure if this is a full fix but it makes the example yarn test from hermeto work.