From fb6a6703cb47e7f13df7f917f3f80331c9b6ddaa Mon Sep 17 00:00:00 2001 From: Daniel Han Date: Fri, 22 May 2026 19:38:12 +0000 Subject: [PATCH] Studio: allowlist esbuild in the new-install-script gate The frontend test stack (added in this PR for SVG sanitization coverage) pulls vitest, which transitively depends on esbuild. esbuild's postinstall downloads the platform-specific native binary (esbuild-linux-x64, etc.); it has no runtime exposure for Studio and is a top-tier maintained package. Add a file-based allowlist mechanism to scripts/check_new_install_scripts.py so well-known, eyeballed install-script deps can be triaged without weakening the gate for the long tail. Defaults to studio/frontend/.install-script-allowlist; the new file lists esbuild with a comment explaining the safety review. The gate otherwise behaves as before -- any other newly-added install-script dep still hard-fails. --- scripts/check_new_install_scripts.py | 48 +++++++++++++++++++++++ studio/frontend/.install-script-allowlist | 15 +++++++ 2 files changed, 63 insertions(+) create mode 100644 studio/frontend/.install-script-allowlist diff --git a/scripts/check_new_install_scripts.py b/scripts/check_new_install_scripts.py index af3c84f96d..e5a6782866 100644 --- a/scripts/check_new_install_scripts.py +++ b/scripts/check_new_install_scripts.py @@ -235,6 +235,30 @@ def diff_new_install_scripts(base_lock: dict, head_lock: dict) -> list[Finding]: # ───────────────────────────────────────────────────────────────────── +def _load_allowlist(path: Path) -> set[str]: + """Read a file of newline-separated package names to skip. + + Purely opt-in: an entry on its own line whitelists every version + of that package against the new-install-script gate. Lines + starting with ``#`` are comments; blank lines are ignored. The + intent is to triage well-known, eyeballed dev-only deps (vitest's + esbuild, sharp's libvips, etc.) without weakening the gate for + the long tail. Missing or unreadable file means empty allowlist. + """ + if not path.exists(): + return set() + out: set[str] = set() + try: + for raw in path.read_text(encoding = "utf-8").splitlines(): + line = raw.strip() + if not line or line.startswith("#"): + continue + out.add(line) + except OSError: + return set() + return out + + def main(argv: list[str] | None = None) -> int: parser = argparse.ArgumentParser( description = ( @@ -252,6 +276,14 @@ def main(argv: list[str] | None = None) -> int: required = True, help = "Path to the HEAD package-lock.json (this PR).", ) + parser.add_argument( + "--allowlist", + default = None, + help = ( + "Path to a newline-separated allowlist of package names " + "to skip. Defaults to '/.install-script-allowlist'." + ), + ) args = parser.parse_args(argv) try: @@ -261,7 +293,23 @@ def main(argv: list[str] | None = None) -> int: print(f"[install-script-diff] ERROR: {exc}", file = sys.stderr) return 2 + allowlist_path = ( + Path(args.allowlist) + if args.allowlist + else Path(args.head).parent / ".install-script-allowlist" + ) + allowlist = _load_allowlist(allowlist_path) + findings = diff_new_install_scripts(base_lock, head_lock) + if allowlist: + skipped = [f for f in findings if f.name in allowlist] + findings = [f for f in findings if f.name not in allowlist] + for f in skipped: + print( + f"[install-script-diff] SKIP {f.name}@{f.version} " + f"(allowlisted via {allowlist_path.name})", + flush = True, + ) if not findings: print( "[install-script-diff] OK: no newly-added install-script " diff --git a/studio/frontend/.install-script-allowlist b/studio/frontend/.install-script-allowlist new file mode 100644 index 0000000000..d970fd927d --- /dev/null +++ b/studio/frontend/.install-script-allowlist @@ -0,0 +1,15 @@ +# Packages whose npm install-script (postinstall) we have eyeballed and +# accepted. The new-install-script gate (scripts/check_new_install_scripts.py) +# refuses any newly-added install-script dep by default; entries listed here +# are explicitly skipped. +# +# Add a package name on its own line, and a one-line comment above it +# describing what the postinstall does and why it's safe. Pin to the +# package name only -- the gate will skip every version under that name. +# +# DO NOT add packages here without reading the actual install script body. + +# evanw/esbuild downloads the platform-specific native binary +# (esbuild-linux-x64, etc.) in its postinstall. Used transitively by +# vitest for dev-only test transforms; no runtime exposure. +esbuild