Skip to content

Commit ba9a818

Browse files
jdaltonjdalton
committed
chore: sync emit-schema scripts from socket-repo-template@563fd6a
Both schema emitters (`scripts/xport-emit-schema.mts`, `scripts/socket-repo-template-emit-schema.mts`) now `pnpm exec oxfmt` their output so the emitted JSON Schema matches what oxfmt produces. Without this, every fleet repo that re-emits would flag the schema as drifted on `pnpm run check --all`. Re-emitted `socket-repo-template-schema.json` through the formatter. (`xport.schema.json` was already at the canonical formatted shape.)
1 parent 8606972 commit ba9a818

3 files changed

Lines changed: 154 additions & 68 deletions

File tree

‎scripts/socket-repo-template-emit-schema.mts‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@ import { writeFileSync } from 'node:fs'
1111
import path from 'node:path'
1212
import { fileURLToPath } from 'node:url'
1313

14+
import { spawn } from '@socketsecurity/lib/spawn'
1415
import { getDefaultLogger } from '@socketsecurity/lib/logger'
1516

1617
import { SocketRepoTemplateConfigSchema } from './socket-repo-template-schema.mts'
@@ -29,4 +30,15 @@ const enriched = {
2930
}
3031

3132
writeFileSync(outPath, JSON.stringify(enriched, null, 2) + '\n', 'utf8')
33+
34+
// Run oxfmt on the output so the file matches what oxfmt would
35+
// produce. Without this, `pnpm run check --all` (which runs oxfmt
36+
// over the tree) would flag the emitted schema as drifted on every
37+
// repo that re-emits it. The schema is in IDENTICAL_FILES, so the
38+
// formatted form is the byte-canonical form fleet-wide.
39+
await spawn('pnpm', ['exec', 'oxfmt', outPath], {
40+
cwd: rootDir,
41+
stdio: 'inherit',
42+
})
43+
3244
logger.success(`wrote ${path.relative(rootDir, outPath)}`)

‎scripts/xport-emit-schema.mts‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@ import { writeFileSync } from 'node:fs'
1212
import path from 'node:path'
1313
import { fileURLToPath } from 'node:url'
1414

15+
import { spawn } from '@socketsecurity/lib/spawn'
1516
import { getDefaultLogger } from '@socketsecurity/lib/logger'
1617

1718
import { XportManifestSchema } from './xport-schema.mts'
@@ -34,4 +35,15 @@ const enriched = {
3435
}
3536

3637
writeFileSync(outPath, JSON.stringify(enriched, null, 2) + '\n', 'utf8')
38+
39+
// Run oxfmt on the output so the file matches what oxfmt would
40+
// produce. Without this, `pnpm run check --all` (which runs oxfmt
41+
// over the tree) would flag the emitted schema as drifted on every
42+
// repo that re-emits it. The schema is in IDENTICAL_FILES, so the
43+
// formatted form is the byte-canonical form fleet-wide.
44+
await spawn('pnpm', ['exec', 'oxfmt', outPath], {
45+
cwd: rootDir,
46+
stdio: 'inherit',
47+
})
48+
3749
logger.success(`wrote ${path.relative(rootDir, outPath)}`)

‎socket-repo-template-schema.json‎

Lines changed: 130 additions & 68 deletions
Original file line numberDiff line numberDiff line change
@@ -2,164 +2,226 @@
22
"$schema": "https://json-schema.org/draft/2020-12/schema",
33
"$id": "https://github.com/SocketDev/socket-repo-template-schema.json",
44
"title": "socket-repo-template per-repo config",
5-
"type": "object",
65
"description": "Per-repo socket-repo-template config. Lives at the fleet repo root as `.socket-repo-template.json`.",
6+
"type": "object",
77
"required": ["schemaVersion", "repoName", "kind"],
8-
"additionalProperties": false,
98
"properties": {
109
"$schema": {
11-
"type": "string",
12-
"description": "JSON Schema reference for editor autocompletion. Conventionally `./socket-repo-template-schema.json`."
10+
"description": "JSON Schema reference for editor autocompletion. Conventionally `./socket-repo-template-schema.json`.",
11+
"type": "string"
1312
},
1413
"schemaVersion": {
14+
"description": "Schema version. Bump on breaking changes; readers gate on it.",
1515
"const": 1,
16-
"description": "Schema version. Bump on breaking changes; readers gate on it."
16+
"type": "number"
1717
},
1818
"repoName": {
19-
"type": "string",
2019
"pattern": "^[a-z0-9][a-z0-9-]*$",
21-
"description": "Canonical repo basename (e.g. `socket-lib`, `ultrathink`). Used for kind-independent exemptions like the oxlint `socket-lib` carve-out."
20+
"description": "Canonical repo basename (e.g. `socket-lib`, `ultrathink`). Used for kind-independent exemptions like the oxlint `socket-lib` carve-out.",
21+
"type": "string"
2222
},
2323
"kind": {
2424
"description": "Fleet repo category. Determines which opt-in files the repo must ship and which it must not. See README.md \"Fleet kinds\" for the table.",
25-
"enum": [
26-
"single-package",
27-
"mono-no-native",
28-
"consumer",
29-
"producer",
30-
"both",
31-
"lang-ports"
25+
"anyOf": [
26+
{
27+
"const": "single-package",
28+
"type": "string"
29+
},
30+
{
31+
"const": "mono-no-native",
32+
"type": "string"
33+
},
34+
{
35+
"const": "consumer",
36+
"type": "string"
37+
},
38+
{
39+
"const": "producer",
40+
"type": "string"
41+
},
42+
{
43+
"const": "both",
44+
"type": "string"
45+
},
46+
{
47+
"const": "lang-ports",
48+
"type": "string"
49+
}
3250
]
3351
},
3452
"hooks": {
35-
"type": "object",
3653
"description": "Git-hook opt-ins.",
37-
"additionalProperties": false,
54+
"type": "object",
3855
"properties": {
3956
"enablePrePush": {
40-
"type": "boolean",
41-
"description": "Wire `.husky/pre-push` → `.git-hooks/pre-push.mts`. Mandatory security gate; default true."
57+
"description": "Wire `.husky/pre-push` → `.git-hooks/pre-push.mts`. Mandatory security gate; default true.",
58+
"type": "boolean"
4259
},
4360
"enableCommitMsg": {
44-
"type": "boolean",
45-
"description": "Wire `.husky/commit-msg` → `.git-hooks/commit-msg.mts`. Strips AI attribution; default true."
61+
"description": "Wire `.husky/commit-msg` → `.git-hooks/commit-msg.mts`. Strips AI attribution; default true.",
62+
"type": "boolean"
4663
},
4764
"enablePreCommit": {
48-
"type": "boolean",
49-
"description": "Wire `.husky/pre-commit` → `.git-hooks/pre-commit.mts`. Lint + secret scan on staged files; default true."
65+
"description": "Wire `.husky/pre-commit` → `.git-hooks/pre-commit.mts`. Lint + secret scan on staged files; default true.",
66+
"type": "boolean"
5067
},
5168
"preCommitVariant": {
52-
"enum": ["lint-only", "lint-test"],
53-
"description": "`lint-only` runs format + secret scan; `lint-test` adds vitest on touched packages. Default `lint-test`."
69+
"description": "`lint-only` runs format + secret scan; `lint-test` adds vitest on touched packages. Default `lint-test`.",
70+
"anyOf": [
71+
{
72+
"const": "lint-only",
73+
"type": "string"
74+
},
75+
{
76+
"const": "lint-test",
77+
"type": "string"
78+
}
79+
]
5480
}
5581
}
5682
},
5783
"scripts": {
58-
"type": "object",
5984
"description": "package.json script tracking overrides.",
60-
"additionalProperties": false,
85+
"type": "object",
6186
"properties": {
6287
"required": {
88+
"description": "Override REQUIRED_SCRIPTS from manifest.mts. Usually omitted — the fleet default applies.",
6389
"type": "array",
64-
"items": { "type": "string" },
65-
"description": "Override REQUIRED_SCRIPTS from manifest.mts. Usually omitted — the fleet default applies."
90+
"items": {
91+
"type": "string"
92+
}
6693
},
6794
"optional": {
95+
"description": "Per-script opt-in map keyed by script name. `true` = repo ships this RECOMMENDED script; `false` = explicit opt-out.",
6896
"type": "object",
69-
"additionalProperties": { "type": "boolean" },
70-
"description": "Per-script opt-in map keyed by script name. `true` = repo ships this RECOMMENDED script; `false` = explicit opt-out."
97+
"patternProperties": {
98+
"^(.*)$": {
99+
"type": "boolean"
100+
}
101+
}
71102
},
72103
"bodyExempt": {
104+
"description": "Script names whose body is allowed to drift from the canonical form (e.g. socket-lib runs a richer test runner than the standard `node scripts/test.mts`). Each entry is the script name only.",
73105
"type": "array",
74-
"items": { "type": "string" },
75-
"description": "Script names whose body is allowed to drift from the canonical form (e.g. socket-lib runs a richer test runner than the standard `node scripts/test.mts`). Each entry is the script name only."
106+
"items": {
107+
"type": "string"
108+
}
76109
}
77110
}
78111
},
79112
"lint": {
80-
"type": "object",
81113
"description": "oxlint profile.",
82-
"additionalProperties": false,
114+
"type": "object",
83115
"properties": {
84116
"profile": {
85-
"enum": ["standard", "rich"],
86-
"description": "`standard` requires the fleet plugin set (import + typescript + unicorn). `rich` opts into a wider set; check the runner for the exact basenames currently exempted."
117+
"description": "`standard` requires the fleet plugin set (import + typescript + unicorn). `rich` opts into a wider set; check the runner for the exact basenames currently exempted.",
118+
"anyOf": [
119+
{
120+
"const": "standard",
121+
"type": "string"
122+
},
123+
{
124+
"const": "rich",
125+
"type": "string"
126+
}
127+
]
87128
}
88129
}
89130
},
90131
"workflows": {
91-
"type": "object",
92132
"description": "CI workflow opt-ins.",
93-
"additionalProperties": false,
133+
"type": "object",
94134
"properties": {
95135
"ci": {
96-
"type": "boolean",
97-
"description": "Ship `.github/workflows/ci.yml`."
136+
"description": "Ship `.github/workflows/ci.yml`.",
137+
"type": "boolean"
98138
},
99139
"weeklyUpdate": {
100-
"type": "boolean",
101-
"description": "Ship `.github/workflows/weekly-update.yml`."
140+
"description": "Ship `.github/workflows/weekly-update.yml`.",
141+
"type": "boolean"
102142
},
103143
"provenance": {
104-
"type": "boolean",
105-
"description": "Repo publishes with npm provenance (OIDC). Hint for setup helpers; not enforced by the checker today."
144+
"description": "Repo publishes with npm provenance (OIDC). Hint for setup helpers; not enforced by the checker today.",
145+
"type": "boolean"
106146
},
107147
"requirePinnedFullSha": {
108-
"type": "boolean",
109-
"description": "Enforce 40-char SHA pins on every `uses:` ref. Defaults to true; an opt-out is reserved for special cases (e.g. workflow-dispatch test rigs) and currently has no consumer."
148+
"description": "Enforce 40-char SHA pins on every `uses:` ref. Defaults to true; an opt-out is reserved for special cases (e.g. workflow-dispatch test rigs) and currently has no consumer.",
149+
"type": "boolean"
110150
}
111151
}
112152
},
113153
"claude": {
114-
"type": "object",
115154
"description": "Claude Code opt-ins.",
116-
"additionalProperties": false,
155+
"type": "object",
117156
"properties": {
118157
"includeSecurityScanSkill": {
119-
"type": "boolean",
120-
"description": "Ship `.claude/skills/security-scan/SKILL.md`."
158+
"description": "Ship `.claude/skills/security-scan/SKILL.md`.",
159+
"type": "boolean"
121160
},
122161
"includeSharedSkills": {
123-
"type": "boolean",
124-
"description": "Ship `.claude/skills/_shared/*` — env-check, path-guard-rule, report-format, security-tools, verify-build."
162+
"description": "Ship `.claude/skills/_shared/*` — env-check, path-guard-rule, report-format, security-tools, verify-build.",
163+
"type": "boolean"
125164
},
126165
"includeUpdatingSkill": {
127-
"type": "boolean",
128-
"description": "Ship the dependency-update skill. Reserved — no consumer wired today."
166+
"description": "Ship the dependency-update skill. Reserved — no consumer wired today.",
167+
"type": "boolean"
129168
}
130169
}
131170
},
132171
"workspace": {
133-
"type": "object",
134172
"description": "pnpm-workspace.yaml setting hints. The runner reads from the YAML; this block exists for repos that prefer to declare intent in JSON.",
135-
"additionalProperties": false,
173+
"type": "object",
136174
"properties": {
137175
"allowBuilds": {
176+
"description": "pnpm `onlyBuiltDependencies` allowlist. Map a package name to true/false to grant/deny build scripts.",
138177
"type": "object",
139-
"additionalProperties": { "type": "boolean" },
140-
"description": "pnpm `onlyBuiltDependencies` allowlist. Map a package name to true/false to grant/deny build scripts."
178+
"patternProperties": {
179+
"^(.*)$": {
180+
"type": "boolean"
181+
}
182+
}
141183
},
142184
"blockExoticSubdeps": {
143-
"type": "boolean",
144-
"description": "Refuse transitive git/tarball subdeps (direct git deps still allowed). Required true; the field exists so a repo can document the intent locally."
185+
"description": "Refuse transitive git/tarball subdeps (direct git deps still allowed). Required true; the field exists so a repo can document the intent locally.",
186+
"type": "boolean"
145187
},
146188
"minimumReleaseAge": {
147-
"type": "integer",
148189
"minimum": 0,
149-
"description": "Soak window in minutes before installing freshly-published packages. Fleet default 10080 (= 7 days)."
190+
"description": "Soak window in minutes before installing freshly-published packages. Fleet default 10080 (= 7 days).",
191+
"type": "integer"
150192
},
151193
"minimumReleaseAgeExclude": {
194+
"description": "Scopes / package patterns exempt from the soak window. Socket-owned scopes typically listed here.",
152195
"type": "array",
153-
"items": { "type": "string" },
154-
"description": "Scopes / package patterns exempt from the soak window. Socket-owned scopes typically listed here."
196+
"items": {
197+
"type": "string"
198+
}
155199
},
156200
"resolutionMode": {
157-
"enum": ["highest", "lowest-direct"],
158-
"description": "pnpm `resolutionMode`. Fleet default `highest`."
201+
"description": "pnpm `resolutionMode`. Fleet default `highest`.",
202+
"anyOf": [
203+
{
204+
"const": "highest",
205+
"type": "string"
206+
},
207+
{
208+
"const": "lowest-direct",
209+
"type": "string"
210+
}
211+
]
159212
},
160213
"trustPolicy": {
161-
"enum": ["no-downgrade", "match-spec"],
162-
"description": "pnpm `trustPolicy`. Fleet default `no-downgrade`."
214+
"description": "pnpm `trustPolicy`. Fleet default `no-downgrade`.",
215+
"anyOf": [
216+
{
217+
"const": "no-downgrade",
218+
"type": "string"
219+
},
220+
{
221+
"const": "match-spec",
222+
"type": "string"
223+
}
224+
]
163225
}
164226
}
165227
}

0 commit comments

Comments
 (0)