mirror of
https://github.com/stablyai/orca.git
synced 2026-09-22 08:02:28 +00:00
OrcaWinandOrca Worker
3ae51076b1
* fix(tooling): run oxlint gates without a Windows .cmd shim
`check:code-quality:changed` spawned `pnpm.cmd` without a shell, which Node
refuses under the CVE-2024-27980 mitigation, so the gate died with EINVAL
before linting anything. Resolve oxlint's own Node bin and run it under this
process's node instead — no shim, no shell, no quoting question — and add a
ratchet so the idiom cannot spread back into config/scripts.
* fix(tooling): validate the react-doctor diff base and widen the shim ratchet
`base` reaches cmd.exe unquoted on the shell fallback, so reject anything
outside a git revision before spawning. The ratchet matched only a handful of
runner names, which let `vitest.cmd` through even though config/scripts already
spawns vitest, playwright and electron-builder; match any batch-shim literal
instead, walk subdirectories, and cover tests/tools.
* docs(tooling): state what the shim ratchet and diff-base check miss
Both comments read as complete accounts of their guard's coverage. The revision
class rejects reflog syntax like HEAD@{1}, deliberately, since braces have no
business in a cmd.exe-bound argument; the ratchet misses a drive-lettered
literal because a colon is not in its class. Say so beside the template-literal
ceiling already noted.
---------
Co-authored-by: Orca Worker <orca-worker@localhost>
24 lines
1.1 KiB
JavaScript
24 lines
1.1 KiB
JavaScript
import { createRequire } from 'node:module'
|
|
import path from 'node:path'
|
|
import process from 'node:process'
|
|
|
|
// Why not `pnpm exec oxlint` / `node_modules/.bin/oxlint.cmd`: both land on a
|
|
// Windows .cmd shim, and Node >= 20 refuses to spawn one without `shell: true`
|
|
// (the CVE-2024-27980 mitigation), so every lint gate died with EINVAL before
|
|
// linting anything. Oxlint's bin is a plain Node script, so run it under this
|
|
// process's own node — no shim, no shell, no quoting question.
|
|
export function resolveOxlintInvocation(root = process.cwd()) {
|
|
const requireFromRoot = createRequire(path.join(root, 'package.json'))
|
|
// Oxlint's "exports" hides ./bin, so read the manifest and walk to its bin entry.
|
|
const manifestPath = requireFromRoot.resolve('oxlint/package.json')
|
|
const binField = requireFromRoot('oxlint/package.json').bin
|
|
const binEntry = typeof binField === 'string' ? binField : binField?.oxlint
|
|
if (!binEntry) {
|
|
throw new Error('oxlint package.json declares no "oxlint" bin entry.')
|
|
}
|
|
return {
|
|
command: process.execPath,
|
|
prefixArgs: [path.resolve(path.dirname(manifestPath), binEntry)]
|
|
}
|
|
}
|