Skip to content

Conversation

@rekmarks
Copy link
Member

@rekmarks rekmarks commented Jul 9, 2024

Converts this repository to a monorepo per the conventions of https://github.com/MetaMask/core, with some inspiration from https://github.com/MetaMask/snaps where applicable. Also replaces tsup with ts-bridge per MetaMask/providers#336.

This includes a direct copy of MetaMask/metamask-module-template#246.

mcmire and others added 4 commits June 28, 2024 16:44
A recent commit upgraded the version of Yarn to v4 and removed the Yarn
binary from the repo, thereby requiring that Corepack be installed in
order to install dependencies. The `build-lint-test` was updated to
install Corepack, but not the documentation-related workflows, so they
are failing.

This commit fixes those workflows to install Corepack. It also cleans up
some work that was done in previous commits:

- In the `build-lint-test` workflow we ensure that `prepare` is run once
per Node version we are testing and that `build` and `lint` use the
latest Node version we are testing.
- In steps where we are installing Node just to gain access to the
`corepack` executable, we use `.nvmrc` (the version of Node we use for
development) to know which version of Node to install rather than using
the latest LTS (`lts/*`). For jobs that do not need to concern
themselves with being run in multiple Node versions, this ensures that
consistent Node versions are used in this step vs. the step that is used
to simply restore the Yarn cache.
- The checkout step always goes first, this way `.nvmrc` can be read.
Set up as monorepo per the conventions of the `/core` monorepo, with
some inspiration from `/snaps` where applicable.
@socket-security
Copy link

socket-security bot commented Jul 9, 2024

@socket-security
Copy link

socket-security bot commented Jul 9, 2024

👍 Dependency issues cleared. Learn more about Socket for GitHub ↗︎

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

Ignoring: npm/@jest/[email protected], npm/@metamask/[email protected], npm/@types/[email protected], npm/@types/[email protected], npm/@yarnpkg/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected]

View full report↗︎

Next steps

Take a deeper look at the dependency

Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support [AT] socket [DOT] dev.

Remove the package

If you happen to install a dependency that Socket reports as Known Malware you should immediately remove it and select a different dependency. For other alert types, you may may wish to investigate alternative packages or consider if there are other ways to mitigate the specific risk posed by the dependency.

Mark a package as acceptable risk

To ignore an alert, reply with a comment starting with @SocketSecurity ignore followed by a space separated list of ecosystem/package-name@version specifiers. e.g. @SocketSecurity ignore npm/[email protected] or ignore all packages with @SocketSecurity ignore-all

@rekmarks
Copy link
Member Author

rekmarks commented Jul 9, 2024

@SocketSecurity ignore-all

@rekmarks rekmarks marked this pull request as ready for review July 10, 2024 15:27
@rekmarks rekmarks requested a review from a team July 10, 2024 15:27
@rekmarks rekmarks changed the base branch from main to fix-workflows-for-yarn-v4 July 10, 2024 15:28
@rekmarks rekmarks changed the base branch from fix-workflows-for-yarn-v4 to main July 10, 2024 15:28
@rekmarks rekmarks enabled auto-merge (squash) July 10, 2024 15:35
@rekmarks rekmarks requested a review from Mrtenz July 10, 2024 16:21
@rekmarks rekmarks requested a review from Mrtenz July 12, 2024 09:34
@rekmarks rekmarks merged commit c9cb406 into main Jul 12, 2024
@rekmarks rekmarks deleted the monorepo-setup branch July 12, 2024 09:38
@rekmarks rekmarks mentioned this pull request Jul 15, 2024
rekmarks added a commit that referenced this pull request Jul 15, 2024
Deletes left over cruft missed in #2.
FUDCo added a commit that referenced this pull request Mar 14, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants