Skip to content

Commit

Permalink
Use @lavamoat/allow-scripts
Browse files Browse the repository at this point in the history
  • Loading branch information
Mrtenz committed Oct 31, 2023
1 parent c20a06f commit 6e401d3
Show file tree
Hide file tree
Showing 5 changed files with 98 additions and 51 deletions.
9 changes: 9 additions & 0 deletions .yarn/plugins/@yarnpkg/plugin-allow-scripts.cjs
Original file line number Diff line number Diff line change
@@ -0,0 +1,9 @@
/* eslint-disable */
//prettier-ignore
module.exports = {
name: "@yarnpkg/plugin-allow-scripts",
factory: function (require) {
var plugin=(()=>{var l=Object.defineProperty;var s=Object.getOwnPropertyDescriptor;var a=Object.getOwnPropertyNames;var c=Object.prototype.hasOwnProperty;var p=(t=>typeof require<"u"?require:typeof Proxy<"u"?new Proxy(t,{get:(o,e)=>(typeof require<"u"?require:o)[e]}):t)(function(t){if(typeof require<"u")return require.apply(this,arguments);throw new Error('Dynamic require of "'+t+'" is not supported')});var u=(t,o)=>{for(var e in o)l(t,e,{get:o[e],enumerable:!0})},f=(t,o,e,r)=>{if(o&&typeof o=="object"||typeof o=="function")for(let i of a(o))!c.call(t,i)&&i!==e&&l(t,i,{get:()=>o[i],enumerable:!(r=s(o,i))||r.enumerable});return t};var m=t=>f(l({},"__esModule",{value:!0}),t);var g={};u(g,{default:()=>d});var n=p("@yarnpkg/shell"),x={hooks:{afterAllInstalled:async()=>{let t=await(0,n.execute)("yarn run allow-scripts");t!==0&&process.exit(t)}}},d=x;return m(g);})();
return plugin;
}
};
12 changes: 11 additions & 1 deletion .yarnrc.yml
Original file line number Diff line number Diff line change
@@ -1,7 +1,17 @@
enableScripts: false

enableTelemetry: 0

logFilters:
- code: YN0004
level: discard

nodeLinker: node-modules

plugins:
- path: .yarn/plugins/@yarnpkg/plugin-workspace-tools.cjs
spec: '@yarnpkg/plugin-workspace-tools'
spec: "@yarnpkg/plugin-workspace-tools"
- path: .yarn/plugins/@yarnpkg/plugin-allow-scripts.cjs
spec: "https://raw.githubusercontent.com/LavaMoat/LavaMoat/main/packages/yarn-plugin-allow-scripts/bundles/@yarnpkg/plugin-allow-scripts.js"

yarnPath: .yarn/releases/yarn-3.2.1.cjs
76 changes: 26 additions & 50 deletions README.md
Original file line number Diff line number Diff line change
@@ -1,78 +1,54 @@
# @metamask/template-snap-monorepo

This repository demonstrates how to develop a snap with TypeScript. For detailed instructions, see [the MetaMask documentation](https://docs.metamask.io/guide/snaps.html#serving-a-snap-to-your-local-environment).
This repository demonstrates how to develop a snap with TypeScript. For detailed
instructions, see [the MetaMask documentation](https://docs.metamask.io/guide/snaps.html#serving-a-snap-to-your-local-environment).

MetaMask Snaps is a system that allows anyone to safely expand the capabilities of MetaMask. A _snap_ is a program that we run in an isolated environment that can customize the wallet experience.
MetaMask Snaps is a system that allows anyone to safely expand the capabilities
of MetaMask. A _snap_ is a program that we run in an isolated environment that
can customize the wallet experience.

## Snaps is pre-release software

To interact with (your) Snaps, you will need to install [MetaMask Flask](https://metamask.io/flask/), a canary distribution for developers that provides access to upcoming features.
To interact with (your) Snaps, you will need to install [MetaMask Flask](https://metamask.io/flask/),
a canary distribution for developers that provides access to upcoming features.

## Getting Started

Clone the template-snap repository [using this template](https://github.com/MetaMask/template-snap-monorepo/generate) and setup the development environment:
Clone the template-snap repository [using this template](https://github.
com/MetaMask/template-snap-monorepo/generate) and set up the development
environment:

```shell
yarn install && yarn start
```

## Cloning

This repository contains GitHub Actions that you may find useful, see `.github/workflows` and [Releasing & Publishing](https://github.com/MetaMask/template-snap-monorepo/edit/main/README.md#releasing--publishing) below for more information.
This repository contains GitHub Actions that you may find useful, see
`.github/workflows` and [Releasing & Publishing](https://github.com/MetaMask/template-snap-monorepo/edit/main/README.md#releasing--publishing)
below for more information.

If you clone or create this repository outside the MetaMask GitHub organization, you probably want to run `./scripts/cleanup.sh` to remove some files that will not work properly outside the MetaMask GitHub organization.
If you clone or create this repository outside the MetaMask GitHub organization,
you probably want to run `./scripts/cleanup.sh` to remove some files that will
not work properly outside the MetaMask GitHub organization.

Note that the `action-publish-release.yml` workflow contains a step that publishes the frontend of this snap (contained in the `public/` directory) to GitHub pages. If you do not want to publish the frontend to GitHub pages, simply remove the step named "Publish to GitHub Pages" in that workflow.

If you don't wish to use any of the existing GitHub actions in this repository, simply delete the `.github/workflows` directory.
If you don't wish to use any of the existing GitHub actions in this repository,
simply delete the `.github/workflows` directory.

## Contributing

### Testing and Linting

Run `yarn test` to run the tests once.

Run `yarn lint` to run the linter, or run `yarn lint:fix` to run the linter and fix any automatically fixable issues.

### Releasing & Publishing

The project follows the same release process as the other libraries in the MetaMask organization. The GitHub Actions [`action-create-release-pr`](https://github.com/MetaMask/action-create-release-pr) and [`action-publish-release`](https://github.com/MetaMask/action-publish-release) are used to automate the release process; see those repositories for more information about how they work.

1. Choose a release version.

- The release version should be chosen according to SemVer. Analyze the changes to see whether they include any breaking changes, new features, or deprecations, then choose the appropriate SemVer version. See [the SemVer specification](https://semver.org/) for more information.

2. If this release is backporting changes onto a previous release, then ensure there is a major version branch for that version (e.g. `1.x` for a `v1` backport release).

- The major version branch should be set to the most recent release with that major version. For example, when backporting a `v1.0.2` release, you'd want to ensure there was a `1.x` branch that was set to the `v1.0.1` tag.

3. Trigger the [`workflow_dispatch`](https://docs.github.com/en/actions/reference/events-that-trigger-workflows#workflow_dispatch) event [manually](https://docs.github.com/en/actions/managing-workflow-runs/manually-running-a-workflow) for the `Create Release Pull Request` action to create the release PR.

- For a backport release, the base branch should be the major version branch that you ensured existed in step 2. For a normal release, the base branch should be the main branch for that repository (which should be the default value).
- This should trigger the [`action-create-release-pr`](https://github.com/MetaMask/action-create-release-pr) workflow to create the release PR.

4. Update the changelog to move each change entry into the appropriate change category ([See here](https://keepachangelog.com/en/1.0.0/#types) for the full list of change categories, and the correct ordering), and edit them to be more easily understood by users of the package.

- Generally any changes that don't affect consumers of the package (e.g. lockfile changes or development environment changes) are omitted. Exceptions may be made for changes that might be of interest despite not having an effect upon the published package (e.g. major test improvements, security improvements, improved documentation, etc.).
- Try to explain each change in terms that users of the package would understand (e.g. avoid referencing internal variables/concepts).
- Consolidate related changes into one change entry if it makes it easier to explain.
- Run `yarn auto-changelog validate --rc` to check that the changelog is correctly formatted.

5. Review and QA the release.

- If changes are made to the base branch, the release branch will need to be updated with these changes and review/QA will need to restart again. As such, it's probably best to avoid merging other PRs into the base branch while review is underway.

6. Squash & Merge the release.

- This should trigger the [`action-publish-release`](https://github.com/MetaMask/action-publish-release) workflow to tag the final release commit and publish the release on GitHub.

7. Publish the release on npm.
Run `yarn lint` to run the linter, or run `yarn lint:fix` to run the linter and
fix any automatically fixable issues.

- Be very careful to use a clean local environment to publish the release, and follow exactly the same steps used during CI.
- Use `npm publish --dry-run` to examine the release contents to ensure the correct files are included. Compare to previous releases if necessary (e.g. using `https://unpkg.com/browse/[package name]@[package version]/`).
- Once you are confident the release contents are correct, publish the release using `npm publish`.
### Using NPM packages with scripts

## Notes
Scripts are disabled by default for security reasons. If you need to use NPM
packages with scripts, you can run `yarn allow-scripts auto`, and enable the
script in the `lavamoat.allowScripts` section of `package.json`.

- Babel is used for transpiling TypeScript to JavaScript, so when building with the CLI,
`transpilationMode` must be set to `localOnly` (default) or `localAndDeps`.
See the documentation for [@lavamoat/allow-scripts](https://github.com/LavaMoat/LavaMoat/tree/main/packages/allow-scripts)
for more information.
9 changes: 9 additions & 0 deletions package.json
Original file line number Diff line number Diff line change
Expand Up @@ -27,6 +27,8 @@
"test": "yarn workspace snap run test"
},
"devDependencies": {
"@lavamoat/allow-scripts": "^3.0.0",
"@lavamoat/preinstall-always-fail": "^2.0.0",
"@metamask/eslint-config": "^10.0.0",
"@metamask/eslint-config-jest": "^10.0.0",
"@metamask/eslint-config-nodejs": "^10.0.0",
Expand All @@ -42,10 +44,17 @@
"eslint-plugin-prettier": "^4.2.1",
"prettier": "^2.2.1",
"prettier-plugin-packagejson": "^2.2.18",
"sharp": "^0.32.6",
"typescript": "^4.7.4"
},
"packageManager": "[email protected]",
"engines": {
"node": ">=18.6.0"
},
"lavamoat": {
"allowScripts": {
"@lavamoat/preinstall-always-fail": false,
"sharp": true
}
}
}
43 changes: 43 additions & 0 deletions yarn.lock
Original file line number Diff line number Diff line change
Expand Up @@ -3812,6 +3812,13 @@ __metadata:
languageName: node
linkType: hard

"@lavamoat/preinstall-always-fail@npm:^2.0.0":
version: 2.0.0
resolution: "@lavamoat/preinstall-always-fail@npm:2.0.0"
checksum: a69c712e9a01029cacc8f77f7b9a944a285d9532583c09fc6050baef098d962d7dea18f17f446ca1f0ec3cd1eea07bfaedd583a704e016889cae1eba7f3552fd
languageName: node
linkType: hard

"@lezer/common@npm:^0.15.0, @lezer/common@npm:^0.15.7":
version: 0.15.12
resolution: "@lezer/common@npm:0.15.12"
Expand Down Expand Up @@ -4491,6 +4498,8 @@ __metadata:
version: 0.0.0-use.local
resolution: "@metamask/template-snap-monorepo@workspace:."
dependencies:
"@lavamoat/allow-scripts": ^3.0.0
"@lavamoat/preinstall-always-fail": ^2.0.0
"@metamask/eslint-config": ^10.0.0
"@metamask/eslint-config-jest": ^10.0.0
"@metamask/eslint-config-nodejs": ^10.0.0
Expand All @@ -4506,6 +4515,7 @@ __metadata:
eslint-plugin-prettier: ^4.2.1
prettier: ^2.2.1
prettier-plugin-packagejson: ^2.2.18
sharp: ^0.32.6
typescript: ^4.7.4
languageName: unknown
linkType: soft
Expand Down Expand Up @@ -10278,6 +10288,13 @@ __metadata:
languageName: node
linkType: hard

"detect-libc@npm:^2.0.2":
version: 2.0.2
resolution: "detect-libc@npm:2.0.2"
checksum: 2b2cd3649b83d576f4be7cc37eb3b1815c79969c8b1a03a40a4d55d83bc74d010753485753448eacb98784abf22f7dbd3911fd3b60e29fda28fed2d1a997944d
languageName: node
linkType: hard

"detect-newline@npm:3.1.0, detect-newline@npm:^3.0.0":
version: 3.1.0
resolution: "detect-newline@npm:3.1.0"
Expand Down Expand Up @@ -16803,6 +16820,15 @@ __metadata:
languageName: node
linkType: hard

"node-addon-api@npm:^6.1.0":
version: 6.1.0
resolution: "node-addon-api@npm:6.1.0"
dependencies:
node-gyp: latest
checksum: 3a539510e677cfa3a833aca5397300e36141aca064cdc487554f2017110709a03a95da937e98c2a14ec3c626af7b2d1b6dabe629a481f9883143d0d5bff07bf2
languageName: node
linkType: hard

"node-domexception@npm:^1.0.0":
version: 1.0.0
resolution: "node-domexception@npm:1.0.0"
Expand Down Expand Up @@ -20061,6 +20087,23 @@ __metadata:
languageName: node
linkType: hard

"sharp@npm:^0.32.6":
version: 0.32.6
resolution: "sharp@npm:0.32.6"
dependencies:
color: ^4.2.3
detect-libc: ^2.0.2
node-addon-api: ^6.1.0
node-gyp: latest
prebuild-install: ^7.1.1
semver: ^7.5.4
simple-get: ^4.0.1
tar-fs: ^3.0.4
tunnel-agent: ^0.6.0
checksum: 0cca1d16b1920800c0e22d27bc6305f4c67c9ebe44f67daceb30bf645ae39e7fb7dfbd7f5d6cd9f9eebfddd87ac3f7e2695f4eb906d19b7a775286238e6a29fc
languageName: node
linkType: hard

"shasum-object@npm:^1.0.0":
version: 1.0.0
resolution: "shasum-object@npm:1.0.0"
Expand Down

0 comments on commit 6e401d3

Please sign in to comment.