ceos/unsloth
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Studio: allowlist esbuild in the new-install-script gate

Browse source 
The frontend test stack (added in this PR for SVG sanitization
coverage) pulls vitest, which transitively depends on esbuild.
esbuild's postinstall downloads the platform-specific native
binary (esbuild-linux-x64, etc.); it has no runtime exposure for
Studio and is a top-tier maintained package.

Add a file-based allowlist mechanism to
scripts/check_new_install_scripts.py so well-known, eyeballed
install-script deps can be triaged without weakening the gate
for the long tail. Defaults to
studio/frontend/.install-script-allowlist; the new file lists
esbuild with a comment explaining the safety review. The gate
otherwise behaves as before -- any other newly-added
install-script dep still hard-fails.
This commit is contained in:
Daniel Han 2026-05-22 19:38:12 +00:00 • committed by danielhanchen
commit fb6a6703cb
2 changed files with 63 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

48
scripts/check_new_install_scripts.py
View file

@ -235,6 +235,30 @@ def diff_new_install_scripts(base_lock: dict, head_lock: dict) -> list[Finding]:
# ─────────────────────────────────────────────────────────────────────
def _load_allowlist(path: Path) -> set[str]:
"""Read a file of newline-separated package names to skip.
Purely opt-in: an entry on its own line whitelists every version
of that package against the new-install-script gate. Lines
starting with ``#`` are comments; blank lines are ignored. The
intent is to triage well-known, eyeballed dev-only deps (vitest's
esbuild, sharp's libvips, etc.) without weakening the gate for
the long tail. Missing or unreadable file means empty allowlist.
"""
if not path.exists():
return set()
out: set[str] = set()
try:
for raw in path.read_text(encoding = "utf-8").splitlines():
line = raw.strip()
if not line or line.startswith("#"):
continue
out.add(line)
except OSError:
return set()
return out
def main(argv: list[str] | None = None) -> int:
parser = argparse.ArgumentParser(
description = (
@ -252,6 +276,14 @@ def main(argv: list[str] | None = None) -> int:
required = True,
help = "Path to the HEAD package-lock.json (this PR).",
)
parser.add_argument(
"--allowlist",
default = None,
help = (
"Path to a newline-separated allowlist of package names "
"to skip. Defaults to '<head dir>/.install-script-allowlist'."
),
)
args = parser.parse_args(argv)
try:
@ -261,7 +293,23 @@ def main(argv: list[str] | None = None) -> int:
print(f"[install-script-diff] ERROR: {exc}", file = sys.stderr)
return 2
allowlist_path = (
Path(args.allowlist)
if args.allowlist
else Path(args.head).parent / ".install-script-allowlist"
)
allowlist = _load_allowlist(allowlist_path)
findings = diff_new_install_scripts(base_lock, head_lock)
if allowlist:
skipped = [f for f in findings if f.name in allowlist]
findings = [f for f in findings if f.name not in allowlist]
for f in skipped:
print(
f"[install-script-diff] SKIP {f.name}@{f.version} "
f"(allowlisted via {allowlist_path.name})",
flush = True,
)
if not findings:
print(
"[install-script-diff] OK: no newly-added install-script "

15
studio/frontend/.install-script-allowlist Normal file
View file

@ -0,0 +1,15 @@
# Packages whose npm install-script (postinstall) we have eyeballed and
# accepted. The new-install-script gate (scripts/check_new_install_scripts.py)
# refuses any newly-added install-script dep by default; entries listed here
# are explicitly skipped.
#
# Add a package name on its own line, and a one-line comment above it
# describing what the postinstall does and why it's safe. Pin to the
# package name only -- the gate will skip every version under that name.
#
# DO NOT add packages here without reading the actual install script body.
# evanw/esbuild downloads the platform-specific native binary
# (esbuild-linux-x64, etc.) in its postinstall. Used transitively by
# vitest for dev-only test transforms; no runtime exposure.
esbuild