From 937ec4e91dfa0e4567ce367483c32fefcf49ed2e Mon Sep 17 00:00:00 2001 From: Daniel Ochoa Date: Fri, 5 Jun 2026 23:19:37 -0500 Subject: [PATCH 1/2] Adopt pnpm 11 install policy Updates the desktop workspace to pnpm 11.3.0 and replaces onlyBuiltDependencies with allowBuilds approvals for audited desktop install scripts. Keeps unreviewed transitive build scripts denied unless a reviewed desktop path requires them. --- CONTRIBUTING.md | 2 +- README.md | 2 +- package.json | 2 +- pnpm-workspace.yaml | 27 +++++++++++++++------------ 4 files changed, 18 insertions(+), 15 deletions(-) diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 3b7b47d7..bb671681 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -7,7 +7,7 @@ We welcome contributions! This guide covers everything you need to get started. ### Prerequisites - **Node.js** 24+ for development, build, and test tooling; Electron's bundled runtime Node version is unchanged. -- **pnpm** 10.32.1 (`corepack enable && corepack prepare pnpm@10.32.1 --activate`) +- **pnpm** 11.3.0 (`corepack enable && corepack prepare pnpm@11.3.0 --activate`) - **just** command runner (`brew install just`) - **macOS** (Electron desktop builds target macOS only) diff --git a/README.md b/README.md index cc35e278..953f6712 100644 --- a/README.md +++ b/README.md @@ -5,7 +5,7 @@ Electron desktop app for the [ClosedLoop](https://closedloop.ai) platform. Provi ## Prerequisites - **Node.js** 24+ for development, build, and test tooling; Electron's bundled runtime Node version is unchanged. -- **pnpm** 10.32.1 (`corepack enable && corepack prepare pnpm@10.32.1 --activate`) +- **pnpm** 11.3.0 (`corepack enable && corepack prepare pnpm@11.3.0 --activate`) - **just** command runner (`brew install just`) - **macOS** or **Linux** (packaging currently macOS-only; Linux runs via `just desktop-dev`) diff --git a/package.json b/package.json index a465c19d..413b9d87 100644 --- a/package.json +++ b/package.json @@ -1,7 +1,7 @@ { "name": "closedloop-electron", "private": true, - "packageManager": "pnpm@10.32.1+sha512.a706938f0e89ac1456b6563eab4edf1d1faf3368d1191fc5c59790e96dc918e4456ab2e67d613de1043d2e8c81f87303e6b40d4ffeca9df15ef1ad567348f2be", + "packageManager": "pnpm@11.3.0+sha512.2c403d6594527287672b1f7056343a1f7c3634036a67ffabfcc2b3d7595d843768f8787148d1b57cf7956c90606bbd192857c363af19e96d2d0ec9ec5741d215", "engines": { "node": ">=24" }, diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index a85448c1..99e4e0f5 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -25,15 +25,18 @@ minimumReleaseAgeExclude: # file:, link:) introduced via transitive deps — closes the github-ref bypass. blockExoticSubdeps: true -# pnpm 10 disables postinstall lifecycle scripts by default — also a -# supply-chain mitigation, since malicious packages typically run their -# payload via postinstall. Explicitly allowlist the few packages whose -# postinstall is load-bearing for this Electron app: -# - electron: downloads the platform-specific Electron binary -# - electron-winstaller: builds the Windows installer toolchain -# - esbuild: installs the platform-specific native binary -# Add to this list intentionally, after auditing the package's install script. -onlyBuiltDependencies: - - electron - - electron-winstaller - - esbuild +# pnpm 11 blocks dependency build scripts unless explicitly approved. +# Keep this standalone allowlist limited to audited desktop install scripts. +allowBuilds: + # Transitive telemetry notice script is not required for desktop installs. + '@scarf/scarf': false + # Keep transitive native database addon builds denied unless a reviewed desktop path requires them. + better-sqlite3: false + # Downloads the platform-specific Electron binary. + electron: true + # Builds the Windows installer toolchain. + electron-winstaller: true + # Installs the platform-specific esbuild native binary. + esbuild: true + # Keep transitive image tooling builds denied unless a reviewed desktop path requires them. + sharp: false From 2247b18f208cdb27f2076fe22026fe8c29190615 Mon Sep 17 00:00:00 2001 From: Daniel Ochoa Date: Fri, 5 Jun 2026 23:54:45 -0500 Subject: [PATCH 2/2] Emit desktop version check for all PRs Run the workflow for every PR and no-op when apps/desktop is unchanged so branch protection receives the required context without forcing irrelevant version bumps. --- .github/workflows/version-check.yml | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-) diff --git a/.github/workflows/version-check.yml b/.github/workflows/version-check.yml index ea6fff33..028580bc 100644 --- a/.github/workflows/version-check.yml +++ b/.github/workflows/version-check.yml @@ -3,8 +3,6 @@ name: Desktop Version Bump Check on: pull_request: types: [opened, synchronize, reopened] - paths: - - "apps/desktop/**" jobs: version-bump-check: @@ -16,7 +14,22 @@ jobs: with: fetch-depth: 0 + - name: Detect desktop changes + id: desktop_changes + run: | + BASE_REF="${{ github.event.pull_request.base.ref }}" + BASE=$(git merge-base "origin/$BASE_REF" HEAD) + + if git diff --quiet "$BASE" HEAD -- apps/desktop; then + echo "changed=false" >> "$GITHUB_OUTPUT" + echo "No apps/desktop changes detected; desktop version bump is not required." + else + echo "changed=true" >> "$GITHUB_OUTPUT" + echo "apps/desktop changes detected; desktop version bump is required." + fi + - name: Check desktop version bump + if: steps.desktop_changes.outputs.changed == 'true' run: | BASE_REF="${{ github.event.pull_request.base.ref }}" BASE=$(git merge-base "origin/$BASE_REF" HEAD)