RomanNum3ral
/
gstack
mirror of https://github.com/garrytan/gstack.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

fix(ship): sync package-lock.json version alongside package.json 

/ship Step 12 (carved into bin/gstack-version-bump by #1806) bumps VERSION
and package.json's version but leaves package-lock.json's version field
stale. Every JS-repo ship then carries a spurious 2-line package-lock.json
diff, and `npm ci` warns on the version mismatch. Same bug #1757 fixed
against the old inline-bash surface; #1757 is now CONFLICTING since #1806
moved the code, so this re-ports the fix onto the CLI.

writeLockVersion() mirrors writePkgVersion()'s semantics:
- Silent skip when package-lock.json is absent (yarn/pnpm/bun/no JS).
- Malformed lockfile -> exit 2, no corrupted write.
- I/O failure after package.json already written -> exit 3 (half-write).
- Updates both top-level `version` and packages[""].version
  (lockfileVersion 3 stores the root version in two places).

Wired through both `write` (FRESH bump) and `repair` (DRIFT_STALE_PKG).
The state classifier is intentionally untouched: a stale lockfile root
version never blocks runtime, so it is opportunistically synced but is
not a halt condition.

Tests: 3 existing write/repair assertions updated for the new packageLock
field; 3 new tests cover lockfile sync on write + repair plus the
malformed-lockfile exit-2 guard. Full suite: 32 pass.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
Oliver Harriehausen 2026-06-01 13:21:53 -05:00
parent c43c850cae
commit ace89ac3e7
2 changed files with 99 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

50
bin/gstack-version-bump
View File

@ -101,6 +101,35 @@ function writePkgVersion(cwd: string, version: string): void {
writeFileSync(pkgPath, JSON.stringify(parsed, null, 2) + "\n");
}
/**
* Opportunistically sync package-lock.json (lockfileVersion 3 stores the version
* in two places: top-level `version` and `packages[""].version`). Returns true if
* the lockfile was present and written, false if absent (yarn/pnpm/bun lockfile,
* or no JS at all). Throws on malformed JSON or write failure.
*
* Caller decides whether absence is an error — write() and repair() both treat
* absence as a silent skip. The state classifier intentionally does NOT inspect
* the lockfile: a stale lockfile root version doesn't break `npm ci` or anything
* runtime, so lockfile-only drift is opportunistically corrected on FRESH/repair
* but is not a halt condition.
*/
function writeLockVersion(cwd: string, version: string): boolean {
const lockPath = join(cwd, "package-lock.json");
if (!existsSync(lockPath)) return false;
const raw = readFileSync(lockPath, "utf-8");
let parsed: Record<string, unknown>;
try {
parsed = JSON.parse(raw) as Record<string, unknown>;
} catch {
fail("package-lock.json is not valid JSON. Fix the file before re-running /ship.", 2);
}
parsed.version = version;
const packages = parsed.packages as Record<string, { version?: string }> | undefined;
if (packages && packages[""]) packages[""].version = version;
writeFileSync(lockPath, JSON.stringify(parsed, null, 2) + "\n");
return true;
}
function baseVersion(cwd: string, base: string, versionRel: string): string {
// Verify the base ref resolves, mirroring the Step 12 guard.
try {
@ -172,7 +201,18 @@ function cmdWrite(args: string[], cwd: string): void {
);
}
}
process.stdout.write(JSON.stringify({ wrote: version, packageJson: existsSync(join(cwd, "package.json")) }) + "\n");
let lockfile = false;
try {
lockfile = writeLockVersion(cwd, version!);
} catch {
fail(
"failed to update package-lock.json. VERSION and package.json were written but the lockfile is now stale.",
3,
);
}
process.stdout.write(
JSON.stringify({ wrote: version, packageJson: existsSync(join(cwd, "package.json")), packageLock: lockfile }) + "\n",
);
}
function cmdRepair(args: string[], cwd: string): void {
@ -193,7 +233,13 @@ function cmdRepair(args: string[], cwd: string): void {
} catch {
fail("drift repair failed — could not update package.json.", 3);
}
process.stdout.write(JSON.stringify({ repaired: current }) + "\n");
let lockfile = false;
try {
lockfile = writeLockVersion(cwd, current);
} catch {
fail("drift repair failed — could not update package-lock.json.", 3);
}
process.stdout.write(JSON.stringify({ repaired: current, packageLock: lockfile }) + "\n");
}
// Exported for unit tests (pure logic, no I/O).

54
test/gstack-version-bump.test.ts
View File

@ -54,7 +54,7 @@ describe('write (FRESH bump)', () => {
fs.writeFileSync(path.join(dir, 'VERSION'), '1.0.0.0\n');
fs.writeFileSync(path.join(dir, 'package.json'), JSON.stringify({ name: 'x', version: '1.0.0.0', scripts: { t: 'y' } }, null, 2) + '\n');
const out = execFileSync('bun', [BIN, 'write', '--version', '1.1.0.0'], { cwd: dir }).toString();
expect(JSON.parse(out)).toEqual({ wrote: '1.1.0.0', packageJson: true });
expect(JSON.parse(out)).toEqual({ wrote: '1.1.0.0', packageJson: true, packageLock: false });
expect(fs.readFileSync(path.join(dir, 'VERSION'), 'utf-8').trim()).toBe('1.1.0.0');
const pkg = JSON.parse(fs.readFileSync(path.join(dir, 'package.json'), 'utf-8'));
expect(pkg.version).toBe('1.1.0.0');
@ -72,7 +72,7 @@ describe('write (FRESH bump)', () => {
const d2 = fs.mkdtempSync(path.join(os.tmpdir(), 'vbump-noPkg-'));
fs.writeFileSync(path.join(d2, 'VERSION'), '0.1.0.0\n');
const out = execFileSync('bun', [BIN, 'write', '--version', '0.2.0.0'], { cwd: d2 }).toString();
expect(JSON.parse(out)).toEqual({ wrote: '0.2.0.0', packageJson: false });
expect(JSON.parse(out)).toEqual({ wrote: '0.2.0.0', packageJson: false, packageLock: false });
expect(fs.readFileSync(path.join(d2, 'VERSION'), 'utf-8').trim()).toBe('0.2.0.0');
fs.rmSync(d2, { recursive: true, force: true });
});
@ -86,7 +86,7 @@ describe('repair (DRIFT_STALE_PKG)', () => {
fs.writeFileSync(path.join(dir, 'VERSION'), '2.0.0.0\n');
fs.writeFileSync(path.join(dir, 'package.json'), JSON.stringify({ name: 'x', version: '1.9.0.0' }, null, 2) + '\n');
const out = execFileSync('bun', [BIN, 'repair'], { cwd: dir }).toString();
expect(JSON.parse(out)).toEqual({ repaired: '2.0.0.0' });
expect(JSON.parse(out)).toEqual({ repaired: '2.0.0.0', packageLock: false });
expect(JSON.parse(fs.readFileSync(path.join(dir, 'package.json'), 'utf-8')).version).toBe('2.0.0.0');
expect(fs.readFileSync(path.join(dir, 'VERSION'), 'utf-8').trim()).toBe('2.0.0.0'); // unchanged
});
@ -100,6 +100,54 @@ describe('repair (DRIFT_STALE_PKG)', () => {
});
});
describe('package-lock.json sync', () => {
// lockfileVersion 3 stores the version in two places: top-level `version`
// and packages[""].version. Both must move together or `npm ci` warns.
const mkLock = (dir: string, version: string) =>
fs.writeFileSync(
path.join(dir, 'package-lock.json'),
JSON.stringify({ name: 'x', version, lockfileVersion: 3, packages: { '': { name: 'x', version } } }, null, 2) + '\n',
);
test('write syncs lockfile root + packages[""] version, reports packageLock: true', () => {
const d = fs.mkdtempSync(path.join(os.tmpdir(), 'vbump-lock-write-'));
fs.writeFileSync(path.join(d, 'VERSION'), '1.0.0.0\n');
fs.writeFileSync(path.join(d, 'package.json'), JSON.stringify({ name: 'x', version: '1.0.0.0' }, null, 2) + '\n');
mkLock(d, '1.0.0.0');
const out = execFileSync('bun', [BIN, 'write', '--version', '1.1.0.0'], { cwd: d }).toString();
expect(JSON.parse(out)).toEqual({ wrote: '1.1.0.0', packageJson: true, packageLock: true });
const lock = JSON.parse(fs.readFileSync(path.join(d, 'package-lock.json'), 'utf-8'));
expect(lock.version).toBe('1.1.0.0');
expect(lock.packages[''].version).toBe('1.1.0.0');
fs.rmSync(d, { recursive: true, force: true });
});
test('repair syncs lockfile up to VERSION, reports packageLock: true', () => {
const d = fs.mkdtempSync(path.join(os.tmpdir(), 'vbump-lock-repair-'));
fs.writeFileSync(path.join(d, 'VERSION'), '2.0.0.0\n');
fs.writeFileSync(path.join(d, 'package.json'), JSON.stringify({ name: 'x', version: '1.9.0.0' }, null, 2) + '\n');
mkLock(d, '1.9.0.0');
const out = execFileSync('bun', [BIN, 'repair'], { cwd: d }).toString();
expect(JSON.parse(out)).toEqual({ repaired: '2.0.0.0', packageLock: true });
const lock = JSON.parse(fs.readFileSync(path.join(d, 'package-lock.json'), 'utf-8'));
expect(lock.version).toBe('2.0.0.0');
expect(lock.packages[''].version).toBe('2.0.0.0');
fs.rmSync(d, { recursive: true, force: true });
});
test('malformed package-lock.json fails write with exit 2', () => {
const d = fs.mkdtempSync(path.join(os.tmpdir(), 'vbump-lock-bad-'));
fs.writeFileSync(path.join(d, 'VERSION'), '1.0.0.0\n');
fs.writeFileSync(path.join(d, 'package.json'), JSON.stringify({ name: 'x', version: '1.0.0.0' }, null, 2) + '\n');
fs.writeFileSync(path.join(d, 'package-lock.json'), '{ not valid json');
let code = 0;
try { execFileSync('bun', [BIN, 'write', '--version', '1.1.0.0'], { cwd: d, stdio: 'pipe' }); }
catch (e: any) { code = e.status; }
expect(code).toBe(2);
fs.rmSync(d, { recursive: true, force: true });
});
});
describe('classify (idempotency over a real git base)', () => {
const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'vbump-classify-'));
afterAll(() => { try { fs.rmSync(dir, { recursive: true, force: true }); } catch { /* noop */ } });