From 6b1754469ecffdeb3ff7372ee22d8c0e8c84dd9d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Salvador=20Giron=C3=A8s?= Date: Fri, 9 Oct 2026 11:38:12 +0200 Subject: [PATCH] Guard benchmark tooling dependency installs --- .github/workflows/ai-gateway-benchmarks.yml | 5 ++++- .github/workflows/ai-gateway-model-index.yml | 9 ++++++--- .github/workflows/browser-benchmarks.yml | 10 ++++++++-- .../workflows/browser-concurrent-benchmarks.yml | 10 ++++++++-- .../workflows/browser-throughput-benchmarks.yml | 10 ++++++++-- .github/workflows/ci.yml | 5 ++++- .github/workflows/pricing-svg.yml | 7 +++++-- .github/workflows/release.yml | 5 ++++- .github/workflows/sandbox-capabilities.yml | 14 ++++++++++---- .github/workflows/sandbox-dax-benchmarks.yml | 10 ++++++++-- .github/workflows/sandbox-tti-benchmarks.yml | 10 ++++++++-- .github/workflows/snapshot-fork-benchmarks.yml | 10 ++++++++-- .github/workflows/storage-benchmarks.yml | 10 ++++++++-- .../workflows/storage-concurrency-benchmarks.yml | 10 ++++++++-- README.md | 9 +++++++++ package.json | 8 ++++---- pnpm-workspace.yaml | 8 ++++++++ 17 files changed, 118 insertions(+), 32 deletions(-) diff --git a/.github/workflows/ai-gateway-benchmarks.yml b/.github/workflows/ai-gateway-benchmarks.yml index 76062f8e5..60032586a 100644 --- a/.github/workflows/ai-gateway-benchmarks.yml +++ b/.github/workflows/ai-gateway-benchmarks.yml @@ -151,9 +151,12 @@ jobs: # Full history so the rebase-on-push retry below has a merge base. fetch-depth: 0 - uses: pnpm/action-setup@v4 + with: + version: 11.28.5 + run_install: false - uses: actions/setup-node@v4 with: - node-version: 24 + node-version: '24' cache: 'pnpm' # ComputeSDK runners get no GitHub OIDC token, so nscloud-setup's # `nsc auth exchange-github-token` cannot work there. Pre-seed the diff --git a/.github/workflows/ai-gateway-model-index.yml b/.github/workflows/ai-gateway-model-index.yml index 9bf43fba4..9741b0c18 100644 --- a/.github/workflows/ai-gateway-model-index.yml +++ b/.github/workflows/ai-gateway-model-index.yml @@ -73,10 +73,13 @@ jobs: - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: fetch-depth: 0 - - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4 + - uses: pnpm/action-setup@v4 # v4 + with: + version: 11.28.5 + run_install: false - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: - node-version: 24 + node-version: '24' # ComputeSDK runners get no GitHub OIDC token, so nscloud-setup's # `nsc auth exchange-github-token` cannot work there. Pre-seed the # workload token file it checks for when NSC_TOKEN is available; @@ -100,7 +103,7 @@ jobs: fi - uses: namespacelabs/nscloud-setup@df198f982fcecfb8264bea3f1274b56a61b6dfdc # v0.0.12 - name: Install dependencies - run: pnpm install --frozen-lockfile + run: pnpm install --frozen-lockfile --ignore-scripts - name: Build workspace packages run: pnpm -r --filter './packages/**' run build - name: Run AI gateway model index diff --git a/.github/workflows/browser-benchmarks.yml b/.github/workflows/browser-benchmarks.yml index 70485567a..84380f3ec 100644 --- a/.github/workflows/browser-benchmarks.yml +++ b/.github/workflows/browser-benchmarks.yml @@ -79,9 +79,12 @@ jobs: steps: - uses: actions/checkout@v4 - uses: pnpm/action-setup@v4 + with: + version: 11.28.5 + run_install: false - uses: actions/setup-node@v4 with: - node-version: 24 + node-version: '24' cache: 'pnpm' # ComputeSDK runners get no GitHub OIDC token, so nscloud-setup's # `nsc auth exchange-github-token` cannot work there. Pre-seed the @@ -154,9 +157,12 @@ jobs: # fail when the remote has advanced past the shallow boundary. fetch-depth: 0 - uses: pnpm/action-setup@v4 + with: + version: 11.28.5 + run_install: false - uses: actions/setup-node@v4 with: - node-version: 24 + node-version: '24' cache: 'pnpm' # ComputeSDK runners get no GitHub OIDC token, so nscloud-setup's # `nsc auth exchange-github-token` cannot work there. Pre-seed the diff --git a/.github/workflows/browser-concurrent-benchmarks.yml b/.github/workflows/browser-concurrent-benchmarks.yml index 6f4e5c45a..d3159ae8c 100644 --- a/.github/workflows/browser-concurrent-benchmarks.yml +++ b/.github/workflows/browser-concurrent-benchmarks.yml @@ -144,9 +144,12 @@ jobs: steps: - uses: actions/checkout@v4 - uses: pnpm/action-setup@v4 + with: + version: 11.28.5 + run_install: false - uses: actions/setup-node@v4 with: - node-version: 24 + node-version: '24' cache: 'pnpm' # ComputeSDK runners get no GitHub OIDC token, so nscloud-setup's # `nsc auth exchange-github-token` cannot work there. Pre-seed the @@ -232,9 +235,12 @@ jobs: with: fetch-depth: 0 - uses: pnpm/action-setup@v4 + with: + version: 11.28.5 + run_install: false - uses: actions/setup-node@v4 with: - node-version: 24 + node-version: '24' cache: 'pnpm' # ComputeSDK runners get no GitHub OIDC token, so nscloud-setup's # `nsc auth exchange-github-token` cannot work there. Pre-seed the diff --git a/.github/workflows/browser-throughput-benchmarks.yml b/.github/workflows/browser-throughput-benchmarks.yml index 4980c3584..021d78efd 100644 --- a/.github/workflows/browser-throughput-benchmarks.yml +++ b/.github/workflows/browser-throughput-benchmarks.yml @@ -131,9 +131,12 @@ jobs: steps: - uses: actions/checkout@v4 - uses: pnpm/action-setup@v4 + with: + version: 11.28.5 + run_install: false - uses: actions/setup-node@v4 with: - node-version: 24 + node-version: '24' cache: 'pnpm' # ComputeSDK runners get no GitHub OIDC token, so nscloud-setup's # `nsc auth exchange-github-token` cannot work there. Pre-seed the @@ -208,9 +211,12 @@ jobs: # fail when the remote has advanced past the shallow boundary. fetch-depth: 0 - uses: pnpm/action-setup@v4 + with: + version: 11.28.5 + run_install: false - uses: actions/setup-node@v4 with: - node-version: 24 + node-version: '24' cache: 'pnpm' # ComputeSDK runners get no GitHub OIDC token, so nscloud-setup's # `nsc auth exchange-github-token` cannot work there. Pre-seed the diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index b106448be..f43b7ae3c 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -21,6 +21,9 @@ jobs: - name: Install pnpm uses: pnpm/action-setup@v4 + with: + version: 11.28.5 + run_install: false - name: Setup Node.js uses: actions/setup-node@v4 with: @@ -28,7 +31,7 @@ jobs: cache: 'pnpm' - name: Install dependencies - run: pnpm install --ignore-scripts + run: pnpm install --frozen-lockfile --ignore-scripts - name: Build packages # The root typecheck consumes the built dist output, so build all diff --git a/.github/workflows/pricing-svg.yml b/.github/workflows/pricing-svg.yml index 2eae534f1..06e5e4624 100644 --- a/.github/workflows/pricing-svg.yml +++ b/.github/workflows/pricing-svg.yml @@ -13,11 +13,14 @@ jobs: steps: - uses: actions/checkout@v4 - uses: pnpm/action-setup@v4 + with: + version: 11.28.5 + run_install: false - uses: actions/setup-node@v4 with: - node-version: 24 + node-version: '24' cache: 'pnpm' - - run: pnpm install --frozen-lockfile + - run: pnpm install --frozen-lockfile --ignore-scripts - run: pnpm run generate-pricing-svg - name: Commit and push run: | diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 9257d0337..d2aa529cb 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -27,6 +27,9 @@ jobs: - name: Install pnpm uses: pnpm/action-setup@v4 + with: + version: 11.28.5 + run_install: false - name: Setup Node.js uses: actions/setup-node@v4 with: @@ -38,7 +41,7 @@ jobs: # Pin to 11.x: npm 12.0.0 ships a broken bundle missing the `sigstore` # module in libnpmpublish, which breaks `publish --provenance` with # "Cannot find module 'sigstore'". - run: npm install -g npm@11 + run: npm install --global --ignore-scripts npm@11.15.0 - name: Install dependencies run: pnpm install --ignore-scripts diff --git a/.github/workflows/sandbox-capabilities.yml b/.github/workflows/sandbox-capabilities.yml index a0dae4c87..d3e129347 100644 --- a/.github/workflows/sandbox-capabilities.yml +++ b/.github/workflows/sandbox-capabilities.yml @@ -94,12 +94,15 @@ jobs: if: env.SHOULD_RUN == 'true' with: persist-credentials: false - - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4 + - uses: pnpm/action-setup@v4 # v4 if: env.SHOULD_RUN == 'true' + with: + version: 11.28.5 + run_install: false - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 if: env.SHOULD_RUN == 'true' with: - node-version: 24 + node-version: '24' cache: 'pnpm' # ComputeSDK runners get no GitHub OIDC token, so nscloud-setup's # `nsc auth exchange-github-token` cannot work there. Pre-seed the @@ -209,10 +212,13 @@ jobs: - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: fetch-depth: 0 - - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4 + - uses: pnpm/action-setup@v4 # v4 + with: + version: 11.28.5 + run_install: false - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: - node-version: 24 + node-version: '24' cache: 'pnpm' # ComputeSDK runners get no GitHub OIDC token, so nscloud-setup's # `nsc auth exchange-github-token` cannot work there. Pre-seed the diff --git a/.github/workflows/sandbox-dax-benchmarks.yml b/.github/workflows/sandbox-dax-benchmarks.yml index 4c5cb6106..0d37ff662 100644 --- a/.github/workflows/sandbox-dax-benchmarks.yml +++ b/.github/workflows/sandbox-dax-benchmarks.yml @@ -113,9 +113,12 @@ jobs: steps: - uses: actions/checkout@v4 - uses: pnpm/action-setup@v4 + with: + version: 11.28.5 + run_install: false - uses: actions/setup-node@v4 with: - node-version: 24 + node-version: '24' cache: 'pnpm' # ComputeSDK runners get no GitHub OIDC token, so nscloud-setup's # `nsc auth exchange-github-token` cannot work there. Pre-seed the @@ -212,9 +215,12 @@ jobs: with: fetch-depth: 0 - uses: pnpm/action-setup@v4 + with: + version: 11.28.5 + run_install: false - uses: actions/setup-node@v4 with: - node-version: 24 + node-version: '24' cache: 'pnpm' # ComputeSDK runners get no GitHub OIDC token, so nscloud-setup's # `nsc auth exchange-github-token` cannot work there. Pre-seed the diff --git a/.github/workflows/sandbox-tti-benchmarks.yml b/.github/workflows/sandbox-tti-benchmarks.yml index b82b30ec1..56948dfaf 100644 --- a/.github/workflows/sandbox-tti-benchmarks.yml +++ b/.github/workflows/sandbox-tti-benchmarks.yml @@ -122,10 +122,13 @@ jobs: if: env.SHOULD_RUN == 'true' - uses: pnpm/action-setup@v4 if: env.SHOULD_RUN == 'true' + with: + version: 11.28.5 + run_install: false - uses: actions/setup-node@v4 if: env.SHOULD_RUN == 'true' with: - node-version: 24 + node-version: '24' cache: 'pnpm' # ComputeSDK runners get no GitHub OIDC token, so nscloud-setup's # `nsc auth exchange-github-token` cannot work there. Pre-seed the @@ -208,9 +211,12 @@ jobs: # fail when the remote has advanced past the shallow boundary. fetch-depth: 0 - uses: pnpm/action-setup@v4 + with: + version: 11.28.5 + run_install: false - uses: actions/setup-node@v4 with: - node-version: 24 + node-version: '24' cache: 'pnpm' # ComputeSDK runners get no GitHub OIDC token, so nscloud-setup's # `nsc auth exchange-github-token` cannot work there. Pre-seed the diff --git a/.github/workflows/snapshot-fork-benchmarks.yml b/.github/workflows/snapshot-fork-benchmarks.yml index d7e7825e7..eaa7894b6 100644 --- a/.github/workflows/snapshot-fork-benchmarks.yml +++ b/.github/workflows/snapshot-fork-benchmarks.yml @@ -98,9 +98,12 @@ jobs: steps: - uses: actions/checkout@v4 - uses: pnpm/action-setup@v4 + with: + version: 11.28.5 + run_install: false - uses: actions/setup-node@v4 with: - node-version: 24 + node-version: '24' cache: 'pnpm' # ComputeSDK runners get no GitHub OIDC token, so nscloud-setup's # `nsc auth exchange-github-token` cannot work there. Pre-seed the @@ -172,9 +175,12 @@ jobs: # fail when the remote has advanced past the shallow boundary. fetch-depth: 0 - uses: pnpm/action-setup@v4 + with: + version: 11.28.5 + run_install: false - uses: actions/setup-node@v4 with: - node-version: 24 + node-version: '24' cache: 'pnpm' # ComputeSDK runners get no GitHub OIDC token, so nscloud-setup's # `nsc auth exchange-github-token` cannot work there. Pre-seed the diff --git a/.github/workflows/storage-benchmarks.yml b/.github/workflows/storage-benchmarks.yml index 534e30708..bc0101290 100644 --- a/.github/workflows/storage-benchmarks.yml +++ b/.github/workflows/storage-benchmarks.yml @@ -97,9 +97,12 @@ jobs: steps: - uses: actions/checkout@v4 - uses: pnpm/action-setup@v4 + with: + version: 11.28.5 + run_install: false - uses: actions/setup-node@v4 with: - node-version: 24 + node-version: '24' cache: 'pnpm' # ComputeSDK runners get no GitHub OIDC token, so nscloud-setup's # `nsc auth exchange-github-token` cannot work there. Pre-seed the @@ -176,9 +179,12 @@ jobs: # fail when the remote has advanced past the shallow boundary. fetch-depth: 0 - uses: pnpm/action-setup@v4 + with: + version: 11.28.5 + run_install: false - uses: actions/setup-node@v4 with: - node-version: 24 + node-version: '24' cache: 'pnpm' # ComputeSDK runners get no GitHub OIDC token, so nscloud-setup's # `nsc auth exchange-github-token` cannot work there. Pre-seed the diff --git a/.github/workflows/storage-concurrency-benchmarks.yml b/.github/workflows/storage-concurrency-benchmarks.yml index 42c890b88..285e3f9ea 100644 --- a/.github/workflows/storage-concurrency-benchmarks.yml +++ b/.github/workflows/storage-concurrency-benchmarks.yml @@ -54,9 +54,12 @@ jobs: with: persist-credentials: false - uses: pnpm/action-setup@v4 + with: + version: 11.28.5 + run_install: false - uses: actions/setup-node@v4 with: - node-version: 24 + node-version: '24' cache: 'pnpm' # ComputeSDK runners get no GitHub OIDC token, so nscloud-setup's # `nsc auth exchange-github-token` cannot work there. Pre-seed the @@ -127,9 +130,12 @@ jobs: with: persist-credentials: false - uses: pnpm/action-setup@v4 + with: + version: 11.28.5 + run_install: false - uses: actions/setup-node@v4 with: - node-version: 24 + node-version: '24' cache: 'pnpm' - name: Install dependencies run: pnpm install --frozen-lockfile --ignore-scripts diff --git a/README.md b/README.md index b0f5e935c..998d23906 100644 --- a/README.md +++ b/README.md @@ -175,3 +175,12 @@ For full details on each suite, see: **Powered by ComputeSDK** — We use [ComputeSDK](https://github.com/computesdk/computesdk), a multi-provider SDK, to test all sandbox providers with the same code. One API, multiple providers, fair comparison. MIT License + +## Maintainer dependency policy + +Use pnpm 11.28.5 with Node.js 22+. CI source installs use frozen locks and +disabled lifecycle hooks. Registry release timestamps are required and the +release delay is enforced even for cached/frozen entries. Existing stronger +delays are preserved. Run reviewed native setup explicitly and install local +git hooks with `pnpm run setup:git-hooks` when that script is present. Public +npm consumer commands and upstream compatibility fixtures remain supported. diff --git a/package.json b/package.json index 8e5639429..ce82f3921 100644 --- a/package.json +++ b/package.json @@ -109,7 +109,7 @@ "bench:ai-gateway-openai:neon": "tsx packages/benchsdk-runner/dist/bin.js run benchmarks/ai-gateway/ai-gateway-openai.bench.ts --provider neon", "bench:ai-gateway-openai:ngrok": "tsx packages/benchsdk-runner/dist/bin.js run benchmarks/ai-gateway/ai-gateway-openai.bench.ts --provider ngrok", "bench:ai-gateway-openai:llmapi": "tsx packages/benchsdk-runner/dist/bin.js run benchmarks/ai-gateway/ai-gateway-openai.bench.ts --provider llmapi", - "generate-ai-gateway-openai-svg": "tsx benchmarks/ai-gateway/generate-svg.ts --dir ai-gateway-latency/openai --title \"AI Gateway Benchmarks — OpenAI\" --out ai-gateway-openai.svg", + "generate-ai-gateway-openai-svg": "tsx benchmarks/ai-gateway/generate-svg.ts --dir ai-gateway-latency/openai --title \"AI Gateway Benchmarks \u2014 OpenAI\" --out ai-gateway-openai.svg", "bench:ai-gateway-gemini": "tsx packages/benchsdk-runner/dist/bin.js run benchmarks/ai-gateway/ai-gateway-gemini.bench.ts", "bench:ai-gateway-gemini:openrouter": "tsx packages/benchsdk-runner/dist/bin.js run benchmarks/ai-gateway/ai-gateway-gemini.bench.ts --provider openrouter", "bench:ai-gateway-gemini:vercel": "tsx packages/benchsdk-runner/dist/bin.js run benchmarks/ai-gateway/ai-gateway-gemini.bench.ts --provider vercel-ai-gateway", @@ -120,7 +120,7 @@ "bench:ai-gateway-gemini:neon": "tsx packages/benchsdk-runner/dist/bin.js run benchmarks/ai-gateway/ai-gateway-gemini.bench.ts --provider neon", "bench:ai-gateway-gemini:ngrok": "tsx packages/benchsdk-runner/dist/bin.js run benchmarks/ai-gateway/ai-gateway-gemini.bench.ts --provider ngrok", "bench:ai-gateway-gemini:llmapi": "tsx packages/benchsdk-runner/dist/bin.js run benchmarks/ai-gateway/ai-gateway-gemini.bench.ts --provider llmapi", - "generate-ai-gateway-gemini-svg": "tsx benchmarks/ai-gateway/generate-svg.ts --dir ai-gateway-latency/gemini --title \"AI Gateway Benchmarks — Gemini\" --out ai-gateway-gemini.svg", + "generate-ai-gateway-gemini-svg": "tsx benchmarks/ai-gateway/generate-svg.ts --dir ai-gateway-latency/gemini --title \"AI Gateway Benchmarks \u2014 Gemini\" --out ai-gateway-gemini.svg", "bench:ai-gateway-kimi": "tsx packages/benchsdk-runner/dist/bin.js run benchmarks/ai-gateway/ai-gateway-kimi.bench.ts", "bench:ai-gateway-kimi:github-copilot": "tsx packages/benchsdk-runner/dist/bin.js run benchmarks/ai-gateway/ai-gateway-kimi.bench.ts --provider github-copilot", "bench:ai-gateway-kimi:openrouter": "tsx packages/benchsdk-runner/dist/bin.js run benchmarks/ai-gateway/ai-gateway-kimi.bench.ts --provider openrouter", @@ -134,7 +134,7 @@ "bench:ai-gateway-kimi:neon": "tsx packages/benchsdk-runner/dist/bin.js run benchmarks/ai-gateway/ai-gateway-kimi.bench.ts --provider neon", "bench:ai-gateway-kimi:ngrok": "tsx packages/benchsdk-runner/dist/bin.js run benchmarks/ai-gateway/ai-gateway-kimi.bench.ts --provider ngrok", "bench:ai-gateway-kimi:llmapi": "tsx packages/benchsdk-runner/dist/bin.js run benchmarks/ai-gateway/ai-gateway-kimi.bench.ts --provider llmapi", - "generate-ai-gateway-kimi-svg": "tsx benchmarks/ai-gateway/generate-svg.ts --dir ai-gateway-latency/kimi --title \"AI Gateway Benchmarks — Kimi\" --out ai-gateway-kimi.svg", + "generate-ai-gateway-kimi-svg": "tsx benchmarks/ai-gateway/generate-svg.ts --dir ai-gateway-latency/kimi --title \"AI Gateway Benchmarks \u2014 Kimi\" --out ai-gateway-kimi.svg", "bench:ai-gateway-model-index": "tsx packages/benchsdk-runner/dist/bin.js run benchmarks/ai-gateway/ai-gateway-model-index.bench.ts", "bench:ai-gateway-model-index:openrouter": "tsx packages/benchsdk-runner/dist/bin.js run benchmarks/ai-gateway/ai-gateway-model-index.bench.ts --provider openrouter", "bench:ai-gateway-model-index:vercel": "tsx packages/benchsdk-runner/dist/bin.js run benchmarks/ai-gateway/ai-gateway-model-index.bench.ts --provider vercel-ai-gateway", @@ -230,5 +230,5 @@ "tsx": "^4.23.15", "typescript": "^5.9.3" }, - "packageManager": "pnpm@10.33.0" + "packageManager": "pnpm@11.28.5" } diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index fe314782d..9a5f10676 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -5,3 +5,11 @@ packages: - packages/create-bench - packages/benchsdk-runner - packages/benchsdk-cli +minimumReleaseAge: 1440 +minimumReleaseAgeStrict: true +blockExoticSubdeps: true +strictDepBuilds: true +ignoreScripts: true +minimumReleaseAgeIgnoreMissingTime: false +trustLockfile: false +optimisticRepeatInstall: false