mosaicstack/stack
25
0
Fork 1
Code Issues 344 Pull Requests 13 Actions Packages Projects Releases 15 Wiki Activity

guides: two measurement rules about pinned tool versions #1316

Merged
gate-merge-01 merged 2 commits from fred/code-review-pinned-tool-rules into next 2026-08-20 16:40:59 +00:00
Conversation 4 Commits 2 Files Changed 1
+9 -6
1 changed files with 9 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Showing only changes of commit 453f495630 - Show all commits
packages/mosaic/framework/guides/CODE-REVIEW.md
+9 -6
View File
@@ -65,12 +65,15 @@ Each of these produced a wrong conclusion before it was written down.
conclusion drawn from it describes the wrong tree. Confirm `git rev-parse --show-toplevel` conclusion drawn from it describes the wrong tree. Confirm `git rev-parse --show-toplevel`
is the tree you think it is before trusting any git output. is the tree you think it is before trusting any git output.
13. **Run the repository's PINNED tool version, not `npx --yes <tool>`.** `npx --yes` ignores the 13. **Run the repository's PINNED tool version.** `npx <tool>` resolves a local `node_modules`
lockfile and fetches the latest release, so it answers about a version the project does not install when one is present and fetches the latest release when one is not, so the same
use. Measured on mosaicstack#1313: the lockfile pins prettier 3.8.1, under which three guides command answers differently depending on where it ran. A reviewer measuring in a fresh clone
pass; `npx --yes prettier` fetched 3.9.6, under which the same three fail; and 3.0.0, the floor or a detached worktree — which is exactly where reviewers measure — has no `node_modules` and
of the declared `^3.0.0` range, fails a different one. Three versions, three verdicts, same silently gets the latest release instead of the pinned one. Measured on mosaicstack#1313: the
bytes. Use `node_modules/.bin/<tool>`, or name the version the lockfile pins. lockfile pins prettier 3.8.1, under which three guides pass; a version-less `npx` in a
worktree resolved 3.9.6, under which the same three fail; and 3.0.0, the floor of the declared
`^3.0.0` range, fails a different one. Three versions, three verdicts, identical bytes. Use
`node_modules/.bin/<tool>`, or name the version the lockfile pins.
14. **A formatter or linter declared as a range is a dated verdict, not a fact.** If a lockfile 14. **A formatter or linter declared as a range is a dated verdict, not a fact.** If a lockfile
pins it, the gate is reproducible today and will disagree with itself the day the pin moves. pins it, the gate is reproducible today and will disagree with itself the day the pin moves.
Report a formatting failure with the version that produced it, always. Report a formatting failure with the version that produced it, always.