ci: daily fresh-install unit tests to catch dep range breakage#2579
Merged
nperez0111 merged 1 commit intomainfrom Mar 20, 2026
Merged
ci: daily fresh-install unit tests to catch dep range breakage#2579nperez0111 merged 1 commit intomainfrom
nperez0111 merged 1 commit intomainfrom
Conversation
Adds a scheduled GitHub Actions workflow that runs the unit test suite after deleting the lockfile and reinstalling deps fresh, to catch breakage from new releases of dependencies like @tiptap/* or prosemirror-* within BlockNote's declared version ranges. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
📝 WalkthroughWalkthroughAdded a new GitHub Actions workflow for daily fresh install testing scheduled at 02:00 UTC and on manual dispatch. The workflow checks out the repository, sets up Node.js and pnpm, installs system dependencies, deletes the lock file to force dependency re-resolution, performs a clean installation, and runs build and unit test commands with caching disabled. Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~12 minutes Poem
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
@blocknote/ariakit
@blocknote/code-block
@blocknote/core
@blocknote/mantine
@blocknote/react
@blocknote/server-util
@blocknote/shadcn
@blocknote/xl-ai
@blocknote/xl-docx-exporter
@blocknote/xl-email-exporter
@blocknote/xl-multi-column
@blocknote/xl-odt-exporter
@blocknote/xl-pdf-exporter
commit: |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
.github/workflows/fresh-install-tests.yml (1)
38-43: Make lockfile deletion resilient withrm -f.Using plain
rmcan fail the workflow if the file is absent in some branches/runs.rm -fkeeps the intent but avoids brittle failures.Small reliability tweak
- run: rm pnpm-lock.yaml + run: rm -f pnpm-lock.yaml🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/workflows/fresh-install-tests.yml around lines 38 - 43, Update the workflow step named "Remove lockfile to force fresh dep resolution" to use a non-failing remove command: replace the current run command `rm pnpm-lock.yaml` with `rm -f pnpm-lock.yaml` so the step is resilient when the lockfile is absent and does not cause the job to fail.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/fresh-install-tests.yml:
- Around line 17-23: The workflow currently inherits token scope; add an
explicit least-privilege permissions block for the fresh-install-unit-tests job
(job name: fresh-install-unit-tests) that grants only what is needed (e.g.,
permissions: contents: read) by inserting a permissions mapping under that job
(or at workflow root) so the checkout/tests run with a read-only token instead
of repo/org defaults.
---
Nitpick comments:
In @.github/workflows/fresh-install-tests.yml:
- Around line 38-43: Update the workflow step named "Remove lockfile to force
fresh dep resolution" to use a non-failing remove command: replace the current
run command `rm pnpm-lock.yaml` with `rm -f pnpm-lock.yaml` so the step is
resilient when the lockfile is absent and does not cause the job to fail.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: d6f3dbe6-a12a-4800-9ec5-489a7133fbd9
📒 Files selected for processing (1)
.github/workflows/fresh-install-tests.yml
Comment on lines
+17
to
+23
| jobs: | ||
| fresh-install-unit-tests: | ||
| name: Unit Tests (Fresh Dep Resolution) | ||
| runs-on: ubuntu-latest | ||
| timeout-minutes: 30 | ||
|
|
||
| steps: |
There was a problem hiding this comment.
Set explicit least-privilege permissions for this workflow.
Right now token scope is inherited from repo/org defaults. Since this job only checks out code and runs tests, you can reduce risk by explicitly granting read-only access.
Suggested hardening
name: Fresh Install Tests
+permissions:
+ contents: read
on:
schedule:
- cron: "0 2 * * *" # Daily at 02:00 UTC🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In @.github/workflows/fresh-install-tests.yml around lines 17 - 23, The workflow
currently inherits token scope; add an explicit least-privilege permissions
block for the fresh-install-unit-tests job (job name: fresh-install-unit-tests)
that grants only what is needed (e.g., permissions: contents: read) by inserting
a permissions mapping under that job (or at workflow root) so the checkout/tests
run with a read-only token instead of repo/org defaults.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds a scheduled GitHub Actions workflow that runs the full unit test suite daily against freshly resolved dependencies (no lockfile), to catch breakage when a new release of a dependency lands within BlockNote's declared version ranges.
Rationale
When BlockNote declares
@tiptap/core: ^3.0.0, a new tiptap patch or minor release could silently break things for users doing a freshnpm install @blocknote/react. Our normal CI uses a frozen lockfile and wouldn't catch this. This workflow simulates exactly the install experience a new user has.Changes
.github/workflows/fresh-install-tests.yml: runs on a daily cron (0 2 * * *) and onworkflow_dispatch, deletespnpm-lock.yamlbefore installing so pnpm resolves all prod/peer deps to their latest versions within declared ranges, then builds and runs the full unit test suite withNX_SKIP_NX_CACHE=true.Impact
No impact on existing workflows or functionality. The new workflow is additive and runs independently on a schedule.
Testing
Steps were verified locally: lockfile deleted →
pnpm install --no-frozen-lockfileresolved fresh deps (tiptap 3.15.3 etc.) →pnpm run buildpassed for all 18 projects →pnpm run testpassed for all 12 test targets with 0 errors.Screenshots/Video
N/A
Checklist
Additional Notes
DevDependencies (vitest, vite, typescript, etc.) are still bounded by their declared ranges in
package.jsoneven without a lockfile — only prod/peer deps get freshly resolved.NX_SKIP_NX_CACHEis set to prevent stale Nx task cache from masking failures.Summary by CodeRabbit