mosaicstack/stack
6
0
Fork 1
Code Issues 298 Pull Requests 18 Actions Packages Projects Releases 15 Wiki Activity

guides: correct rule 13's mechanism per rev-code-02
ci/woodpecker/pr/ci Pipeline was successful
Details

Browse Source 
rev-code-02's suggestion on #1316, and it is right. I wrote that 'npx --yes'
ignores the lockfile. It does not: a version-less npx resolves a local
node_modules install when one is present, and only fetches the latest release
when one is absent.

That makes the rule sharper rather than weaker. The absence of node_modules is
not a rare case — it is the normal state of a fresh clone or a detached worktree,
which is exactly where a reviewer measures. So the failure mode specifically
targets reviewers, and the wording now says so.

Gates re-run with the pinned prettier.
This commit is contained in:
fred
2026-08-19 11:03:18 -05:00
parent 09a1d9f7cd
commit 453f495630
1 changed files with 9 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
packages/mosaic/framework/guides/CODE-REVIEW.md
+9 -6
View File
@@ -65,12 +65,15 @@ Each of these produced a wrong conclusion before it was written down.
conclusion drawn from it describes the wrong tree. Confirm `git rev-parse --show-toplevel` conclusion drawn from it describes the wrong tree. Confirm `git rev-parse --show-toplevel`
is the tree you think it is before trusting any git output. is the tree you think it is before trusting any git output.
13. **Run the repository's PINNED tool version, not `npx --yes <tool>`.** `npx --yes` ignores the 13. **Run the repository's PINNED tool version.** `npx <tool>` resolves a local `node_modules`
lockfile and fetches the latest release, so it answers about a version the project does not install when one is present and fetches the latest release when one is not, so the same
use. Measured on mosaicstack#1313: the lockfile pins prettier 3.8.1, under which three guides command answers differently depending on where it ran. A reviewer measuring in a fresh clone
pass; `npx --yes prettier` fetched 3.9.6, under which the same three fail; and 3.0.0, the floor or a detached worktree — which is exactly where reviewers measure — has no `node_modules` and
of the declared `^3.0.0` range, fails a different one. Three versions, three verdicts, same silently gets the latest release instead of the pinned one. Measured on mosaicstack#1313: the
bytes. Use `node_modules/.bin/<tool>`, or name the version the lockfile pins. lockfile pins prettier 3.8.1, under which three guides pass; a version-less `npx` in a
worktree resolved 3.9.6, under which the same three fail; and 3.0.0, the floor of the declared
`^3.0.0` range, fails a different one. Three versions, three verdicts, identical bytes. Use
`node_modules/.bin/<tool>`, or name the version the lockfile pins.
14. **A formatter or linter declared as a range is a dated verdict, not a fact.** If a lockfile 14. **A formatter or linter declared as a range is a dated verdict, not a fact.** If a lockfile
pins it, the gate is reproducible today and will disagree with itself the day the pin moves. pins it, the gate is reproducible today and will disagree with itself the day the pin moves.
Report a formatting failure with the version that produced it, always. Report a formatting failure with the version that produced it, always.