[PR #982] [MERGED] fix(build): validate installed dependencies before cache hits #2552

New issue

Closed

opened 2026-10-17 21:07:29 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-17 21:07:29 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/982
Author: @morluto
Created: 10/7/2026
Status: ✅ Merged
Merged: 10/7/2026
Merged by: @morluto

Base: main ← Head: codex/audit-wave3-setup

📝 Commits (2)

4f0a0ea fix(build): validate dependencies before cached build
ad8ba3d Merge remote-tracking branch 'origin/main' into codex/audit-wave3-setup

📊 Changes

2 files changed (+183 additions, -4 deletions)

View changed files

📝 package.json (+1 -1)
📝 tests/boundary/filesystem/dependencyInstall.test.ts (+182 -3)

📄 Description

build:cached could return a successful Turbo cache hit without checking whether the installed dependency tree still matched the lockfile. The existing deps:check ran through npm's prebuild lifecycle, which Turbo skips when restoring cached task output.

Run the existing dependency freshness checker before starting Turbo. A regression seeds a real Turbo build cache in an isolated fixture, makes only that fixture's installed hidden lock stale, and verifies the package script rejects it before Turbo; it then confirms Turbo itself still serves the cached build. This preserves the cache benefit while validating the local install state on every invocation.

Validation:

Dependency/cache regression: 5 tests passed, no dependency installation or shared lockfile mutation.
Directly relevant configuration/setup/update suites: 69 tests passed across 7 files.
npm run build:cached, forced npm run check:fast -- --force, npm run format:check, and npm run docs:check passed.
Docs metadata check reports its existing complete:false status.

No real Hopper/Ghidra/IDA verification was needed or performed.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/982 **Author:** [@morluto](https://github.com/morluto) **Created:** 10/7/2026 **Status:** ✅ Merged **Merged:** 10/7/2026 **Merged by:** [@morluto](https://github.com/morluto) **Base:** `main` ← **Head:** `codex/audit-wave3-setup` --- ### 📝 Commits (2) - [`4f0a0ea`](https://github.com/morluto/rea/commit/4f0a0ea9c887a9a6613f0cbecc40389fa3e4a9d7) fix(build): validate dependencies before cached build - [`ad8ba3d`](https://github.com/morluto/rea/commit/ad8ba3d854832e7a76168736a34d04b0706ad815) Merge remote-tracking branch 'origin/main' into codex/audit-wave3-setup ### 📊 Changes **2 files changed** (+183 additions, -4 deletions) <details> <summary>View changed files</summary> 📝 `package.json` (+1 -1) 📝 `tests/boundary/filesystem/dependencyInstall.test.ts` (+182 -3) </details> ### 📄 Description `build:cached` could return a successful Turbo cache hit without checking whether the installed dependency tree still matched the lockfile. The existing `deps:check` ran through npm's `prebuild` lifecycle, which Turbo skips when restoring cached task output. Run the existing dependency freshness checker before starting Turbo. A regression seeds a real Turbo build cache in an isolated fixture, makes only that fixture's installed hidden lock stale, and verifies the package script rejects it before Turbo; it then confirms Turbo itself still serves the cached build. This preserves the cache benefit while validating the local install state on every invocation. Validation: - Dependency/cache regression: 5 tests passed, no dependency installation or shared lockfile mutation. - Directly relevant configuration/setup/update suites: 69 tests passed across 7 files. - `npm run build:cached`, forced `npm run check:fast -- --force`, `npm run format:check`, and `npm run docs:check` passed. - Docs metadata check reports its existing `complete:false` status. No real Hopper/Ghidra/IDA verification was needed or performed. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-17 21:07:29 +00:00

closed this issue
added the
pull-request
label

bsakaguchi referenced this issue

2026-10-31 01:07:32 +00:00

[PR #3000] [CLOSED] test(jeb): cover invalid route rejection through MCP #5554

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#2552

No description provided.

Rows
Columns