test(e2e): run prisma init from the local tarball in the corepack test - #30183
Conversation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yml Review profile: ASSERTIVE Plan: Team Run ID: 📒 Files selected for processing (1)
Included review availability: Your plan provides up to 10 included reviews per hour; 9 remain after this review. 📝 WalkthroughWalkthroughThe Prisma init Corepack E2E test now runs ChangesPrisma init E2E test
Estimated code review effort: 1 (Trivial) | ~2 minutes Merge Risk: ⚪ Minimal · up to This localized test-only change makes the corepack test use the branch’s locally installed Prisma CLI, with no actionable merge-blocking risk remaining after normal checks and review. Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
Full details: Docstring CoverageExplanation No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1 files. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
size-limit report 📦
|
00559b3 to
6ec4a6a
Compare
pnpm dlx prisma init fetches prisma@latest from the registry, which is Prisma 8 since mid-August and rejects the fixture Prisma 7 prisma.config.ts (CLI.CONFIG_MISSING_MARKER), so the test fails on every run. The fixture already installs the prisma tarball under test as a devDependency; run it with pnpm exec instead. Corepack coverage is unchanged: the CLI still runs through a corepack-managed pnpm. Signed-off-by: Oleksii Orlenko <robot@aqrln.net>
6ec4a6a to
c0dba31
Compare
…es (#30189) ## Summary `pnpm audit --prod` (the "Run pnpm audit (production dependencies only)" step of the Lint job) fails on every PR to this branch with four advisories: - `deepmerge-ts` < 8.0.0 — stack exhaustion on recursive object graphs ([GHSA-ggr8-5vv4-36mx](GHSA-ggr8-5vv4-36mx)), high - `mariadb` >= 3.4.0 < 3.4.6 — cleartext password leak to a MitM despite `ssl: true` ([GHSA-cqhc-2h57-wpxf](GHSA-cqhc-2h57-wpxf), high), cleartext transmission of sensitive information ([GHSA-42r5-vhpq-m858](GHSA-42r5-vhpq-m858), moderate), and possible SQL injection in Buffer parameter escaping under multibyte client charsets ([GHSA-g5xc-5w98-jfvm](GHSA-g5xc-5w98-jfvm), moderate) This PR bumps: - `deepmerge-ts` 7.1.5 → 8.0.2 in `packages/config`. The v8 breaking changes are Map deep-merging and a `deepmergeInto` mutation fix; `@prisma/config` uses neither — it only calls the basic `deepmerge` export on plain config objects (`loadConfigFromFile.ts`). v8 still ships dual CJS/ESM. - `mariadb` 3.4.5 → 3.5.3 in `packages/adapter-mariadb`. The advisories say "patched >= 3.4.6", but npm has no 3.4.6 — the 3.4.x line ends at 3.4.5; 3.5.3 is the current release satisfying the range. Lockfile updated with the repo-pinned pnpm 11.13.1. ## Testing performed - `pnpm audit --prod` against the updated lockfile: "No known vulnerabilities found". - `pnpm --filter @prisma/config test`: 4 files, 142 passed, 2 skipped — includes the config-merge tests that exercise `deepmerge`. - `pnpm --filter @prisma/adapter-mariadb test`: 45 passed. ## Notes for the reviewer - After this merges, the Lint job on this branch should go fully green again (its other failure mode, prettier-check, is unaffected here). - Related branch-health PRs: #30180 (rename guards), #30183 (corepack e2e test). <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Chores** * Updated the MariaDB integration dependency to a newer version. * Updated the configuration merge dependency to a newer version. <!-- end of auto-generated comment: release notes by coderabbit.ai --> Signed-off-by: Oleksii Orlenko <robot@aqrln.net>
Summary
The
prisma-init-corepacke2e test fails on every CI run (for example, this shard on #30180, and the same shard on thev7tip's own CI run from 2026-08-27, before that PR existed).Cause: the test runs
pnpm dlx prisma init.dlxignores the locally installed package and fetchesprisma@latestfrom the registry — andlatestis Prisma 8 (8.0.0-rc.12today; Prisma 7 moved to theprevdist-tag). The v8 CLI rejects the fixture's Prisma 7prisma.config.tswithCLI.CONFIG_MISSING_MARKER. The test was green on 2026-08-17 and red by 2026-08-27, matching the dist-tag transition, and can never be green again in this form.Fix: run
pnpm exec prisma initinstead. The fixture already installs theprismatarball under test as a devDependency, soexecmakes the test hermetic and exercises the v7 CLI this branch builds. This matches the siblingprisma-init-buntest, which also runs the locally installed CLI.The corepack regression coverage this test exists for (#28504) is unchanged:
prisma initstill executes in acorepack enabled container through a corepack-managed pnpm (packageManager: pnpm@10.15.1).Testing performed
CLI.CONFIG_MISSING_MARKER, "most likely a Prisma 7 config"), immediately afterdlxdownloadsprismafrom the registry.prismadist-tags arelatest: 8.0.0-rc.12,prev: 7.10.0.Related PRs
github.repositoryguards) — its failing e2e check is this same pre-existing test failure, plus apnpm auditLint failure that is advisory-driven and unrelated.Summary by CodeRabbit