Use ncc and remove node_modules#70
Conversation
|
This is awesome @robertbrignull! I am obviously a big fan of this change 😃 Perhaps as a next step we could even compile a single "binary" which all actions could use as their name: 'CodeQL: Init'
description: 'Setup the CodeQL tracer'
author: 'GitHub'
inputs:
tools:
description: URL of CodeQL tools
required: false
default: https://github.com/github/codeql-action/releases/download/codeql-bundle-20200601/codeql-bundle.tar.gz
languages:
description: The languages to be analysed
required: false
token:
default: ${{ github.token }}
matrix:
default: ${{ toJson(matrix) }}
config-file:
description: Path of the config file to use
required: false
+ command:
+ default: "init"
runs:
using: 'node12'
- main: '../lib/setup-tracer.js'
+ main: '../lib/main.js'
Still Thoughts? Btw, I would love to help in any way I can. |
|
Doesn't the fact that all the code gets bundled into a single minified file make conflicts much more likely? |
@alexkappa, I like the idea of only having one "binary" that we compile. I thought of a different way of then hooking into it by manually writing simple js files like require('main.js').init()and require('main.js').analyze()I'm not really sure which is best. I find putting the command as an input to the action a little odd as it could produce odd behaviour if a user changed it, and we might be obligated to document what it is. However introducing extra files is also a bit annoying.
@chrisgavin, yes, you're right it'll increase the chance of conflicts in the minified code. If we bundle all the files but don't minify them that could reduce it. I think we'd still get conflicts in the map file though almost every time. Fixing these conflicts is not hard to do but it is a pain as you'd have to do it locally and not by clicking a button in the UI. I can't think of a way around this if we want to keep the map files. |
Totally agree, this is much cleaner. It will also enable us to test with more flexibility as we won't have that pesky |
|
Changes made include:
|
|
I think I've addressed all comments and this is ready for a proper review and discussion again. So far I think the only outstanding negative point is that we'll likely get conflicts on every code change that will require running commands locally to fix. |
|
I'm going to close this issue as there isn't enough support to follow through on this and outweigh the downsides. |
This is a prototype of using https://www.npmjs.com/package/@zeit/ncc to bundle all of our code into a js single file per action, instead of having to ship everything. This means we can remove the
libandnode_modulesdirectories from the repository.Ncc is essentially a wrapper around webpack, but it provides a nicer interface for node projects. Using webpack directly would also be an option, but it would require slightly more setup. If it turns out ncc doesn't offer us enough flexibility then I wouldn be opposed to that.
The diff is a bit big for GitHub to display, but here's a summary of what has changed (excluding the
node_modulesandlibdirectories).Some things to note:
setup-tracer.jsfile wasn't being compiled because it isn't executed in the normal way but is instead passed to CodeQL. To get around this I've converted it to javascript manually.sarif_v2.1.0_schema.jsonand other files have been copied fromsrcto the output directories. I view this is a bit unnnecessary and annoying but I haven't found a nice way to stop it. We could probably change the place where we reference this file to comfuse the bundler, but that seems counterproductive. In fact forsetup-tracer.jsandinject-tracer.ps1I modified the code so the builder would recognise the reference and copy the file.index.jsfiles, but this keeps the entrypoints separate so we can just run the file. We could probably change this if we wanted so there's only one file.-marguments means theindex.jsfiles are minimised. This isn't really necessary or hugely helpful other than making our repository a bit smaller.-sargument means we're generating source maps, but I explicitly pass--no-source-map-registerto avoid generatingsourcemap-register.jsfiles. I haven't seen these files before, and googling didn't help me find out what they are for, so I disabled them.avadoesn't support running typescript files directly and you have to pre-compile them and then runavaof the js files. Therefore I've added a call totscwhen running the tests. This means thelibdirectory is still getting used, but only for the tests, and it is excluded from the repository. It also slows down the tests a bit but for me they take 11 seconds which is hopefully still acceptable.Merge / deployment checklist