PR level check that verifies if contributed `package-lock.json` is created with `v2`

derberg commented 2 years ago

We need a new global workflow, with a dedicated configuration in https://github.com/asyncapi/.github/blob/master/.github/workflows/global-replicator.yml that only certain projects can opt into if they want

The goal is that it runs on a PR and it checks if the PR modifies package-lock.json and the file is created with "lockfileVersion": 2. Otherwise the check fails and we post a nice friendly comment saying "oy, sorry but we use lockfileVersion 2, so please make sure you are not using npm 6 to install dependencies in the project, thanks a 💯 " (just an example 😄 ).

Then once the fix is done, we remove the bot comment

smoya commented 2 years ago

@derberg FYI I created an issue in every repository that still sticks to package-lock version 2.

github-actions[bot] commented 1 year ago

This issue has been automatically marked as stale because it has not had recent activity :sleeping:

It will be closed in 120 days if no further activity occurs. To unstale this issue, add a comment with a detailed explanation.

There can be many reasons why some specific issue has no activity. The most probable cause is lack of time, not lack of interest. AsyncAPI Initiative is a Linux Foundation project not owned by a single for-profit company. It is a community-driven initiative ruled under open governance model.

Let us figure out together how to push this issue forward. Connect with us through one of many communication channels we established here.

Thank you for your patience :heart:

derberg commented 1 year ago

we need to be flexible, so if someone wan't to use package-lock v2 and not v3 that is fine. So the check that we roll out must support validation of any version
we need a composite reusable action that checks package-lock version from the default branch, and verifies it against version coming from the PR
now problem is that what if someone intentionally want to switch from v2 to v3? CI will always complain. So we need to make sure that maintainer of given repo can say, "yo, my package lock version for my repo is v2". I think this can be only done through GitHub repo variables:

wdyt?

smoya commented 1 year ago

Maybe we could just check, in the git diff, that the lockVersion is not being degraded? I.e. from 3 to 2.

derberg commented 1 year ago

we would have to assume that nobody intentionally will degrade. But I guess it is not a bad assumption 🤔

you think variables are not good? we can easily set org variable to 2 and then on repo level maintainers can override with local variable