Repository navigation
ci + publish: GitHub Actions, package.json fields, lockfile - #3
Conversation
Runs the mocha suite on every push to master and every PR against master, across Node 20 and 22 (current active LTS). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Aligns meaco's package.json with the org template (cf. jarvis-emitter) and adds the publish-hygiene fields it was missing: - license: "MIT" — matches the existing LICENSE file - files whitelist — ships only index.js, README.md, LICENSE (no test/, .github/, etc.); verified with `npm publish --dry-run`: 4 files, 1.9 kB tarball, 3.7 kB unpacked - engines.node: ">=18" — matches the CI matrix; older Node refuses to install rather than installing-and-failing-mysteriously - prepublishOnly: "npm test" — every `npm publish` runs the mocha suite first; a red test blocks the publish - homepage — points to the README on GitHub - repository.url normalized to "git+https://..." form Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Reproducible installs for developers and CI, enables `npm ci` (stricter than `npm install` — fails on lockfile/package.json drift) and the `cache: npm` step in GitHub Actions. No effect on consumers — npm ignores transitive lockfiles. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
There was a problem hiding this comment.
Pull request overview
Tightens package.json for publish hygiene (adds license, files, engines.node, prepublishOnly, homepage, canonicalizes repository.url) and commits a package-lock.json for reproducible installs. The diff also includes a new .github/workflows/ci.yml, which the PR description attributes to a separate follow-up PR.
Changes:
- Add publish-hygiene fields to
package.json(license, files, engines, prepublishOnly, homepage) and canonicalize repo URL. - Commit
package-lock.json(lockfileVersion 2) for reproducible installs. - Add a GitHub Actions CI workflow running mocha on Node 18/20/22.
Reviewed changes
Copilot reviewed 2 out of 3 changed files in this pull request and generated 3 comments.
| File | Description |
|---|---|
| package.json | Adds license/files/engines/prepublishOnly/homepage and canonical repository URL. |
| package-lock.json | New lockfile pinning all transitive dependencies. |
| .github/workflows/ci.yml | New CI workflow for push/PR on master across Node 18/20/22. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Modeled on the jarvis-emitter workflow: PR-triggered, Node 18.x/20.x/22.x matrix, `npm ci` against the committed lockfile, `cache: npm` for fast installs. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
greg3d
changed the title
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Per PR review (Copilot on package.json:25): the pinned mocha@4.1.0 (2017) pulled in deprecated transitives (glob@7, inflight, mkdirp@0) and a vulnerable minimist@0.0.8 (CVE-2020-7598, prototype pollution). - chai: ^4.1.2 -> ^4.5.0 (latest 4.x; stays CJS — chai 5 is ESM-only) - mocha: ^4.0.1 -> ~11.7.5 (matches jarvis-emitter template) - overrides: force-bump mocha's vulnerable transitives: - diff -> ^8.0.3 (fixes GHSA-73rr-hh4g-fpgx DoS) - serialize-javascript -> ^7.0.3 (fixes GHSA-5c6j-r48x-rmvq RCE, CVSS 8.1) `npm audit` now reports 0 vulnerabilities. Test suite still 9/9 green. These are dev-only dependencies — meaco's published tarball remains 4 files (index.js, README.md, LICENSE, package.json), unchanged. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
greg3d
changed the title
| "LICENSE" | ||
| ], | ||
| "engines": { | ||
| "node": ">=18" |
There was a problem hiding this comment.
engines floor with a minor version bump — quick consumer audit?
engines.node: ">=18" is new in this PR; pairing it with a minor 2.0.0 → 2.1.0 bump means any consumer still on Node <18 with engines-strict=true (or npm install --engine-strict) will see installs of 2.1.0 fail rather than warn. Strict semver would say a new engines floor is a major bump.
Could you check whether anything in MCE still consumes meaco on Node <18? Likely all our consumers are already on ≥18, but I'd rather confirm than assume. If everything's on ≥18 we can accept the deviation and merge as-is — just leave a note here. If anything older turns up, cleanest fix is 3.0.0.
Resolve this thread if there shouldn't be any consumer on Node <18.
Summary
Combines CI setup, publish-readiness improvements, and a dev-dep refresh into one PR. Modeled on the jarvis-emitter template.
1. CI — `.github/workflows/ci.yml`
2. package.json hygiene
3. Lockfile
Adds `package-lock.json` for reproducible installs and to enable `npm ci` + `cache: npm` in CI. No effect on consumers — npm ignores transitive lockfiles.
4. Dev-dep refresh (per Copilot review on `package.json:25`)
The previously pinned `mocha@4.1.0` (2017) pulled in deprecated transitives (`glob@7`, `inflight`, `mkdirp@0`) and `minimist@0.0.8` (CVE-2020-7598, prototype pollution).
`overrides` force-bumps mocha 11.7.x's remaining vulnerable transitives:
`npm audit` is now 0 vulnerabilities. Test suite is 9/9 green on the new toolchain.
These are dev-only deps — they don't ship to consumers (see dry-run below).
Verified with `npm publish --dry-run`
```
📦 meaco@2.1.0
=== Tarball Contents ===
1.1kB LICENSE
76B README.md
1.9kB index.js
740B package.json
package size: 1.9 kB
unpacked size: 3.8 kB
total files: 4
```
No `test/`, no `.github/`, no `package-lock.json`, no `node_modules` in the published tarball. `prepublishOnly` ran the mocha suite before the dry-publish.
Not included (deliberately)
Test plan