sneak/upaas
1
0
Fork 1
Code Issues 7 Pull Requests Actions Packages Projects Releases 1 Wiki Activity

make fmt rewrites vendored static/js/alpine.min.js (missing .prettierignore) #185

New Issue
Open
opened 2026-08-07 18:47:54 +02:00 by clawbot · 1 comment
clawbot commented 2026-08-07 18:47:54 +02:00
Collaborator
Copy Link

Found while working #175: running make fmt reformats
static/js/alpine.min.js — script/fmt passes the glob
static/js/*.js to prettier and there is no .prettierignore, so
the vendored minified Alpine.js bundle gets expanded/rewritten.
Vendored artifacts must never be reformatted; a formatter pass
should leave the tree identical unless first-party code changed.

Remediation: add a .prettierignore containing at least
static/js/alpine.min.js (or *.min.js). Verify script/fmt's
explicit file arguments still respect the ignore file (prettier
requires --ignore-path handling to be confirmed when files are
passed explicitly); if not, adjust the glob in script/fmt to
exclude minified files.

Definition of done:

  • make fmt on a clean tree produces zero modifications
    (git status clean afterward)
  • static/js/alpine.min.js byte-identical before and after
    make fmt
  • first-party JS (dashboard.js, deployment.js, utils.js) is
    still formatted
  • lands via PR from a feature branch off main
Found while working #175: running `make fmt` reformats `static/js/alpine.min.js` — `script/fmt` passes the glob `static/js/*.js` to prettier and there is no `.prettierignore`, so the vendored minified Alpine.js bundle gets expanded/rewritten. Vendored artifacts must never be reformatted; a formatter pass should leave the tree identical unless first-party code changed. Remediation: add a `.prettierignore` containing at least `static/js/alpine.min.js` (or `*.min.js`). Verify `script/fmt`'s explicit file arguments still respect the ignore file (prettier requires `--ignore-path` handling to be confirmed when files are passed explicitly); if not, adjust the glob in `script/fmt` to exclude minified files. Definition of done: - `make fmt` on a clean tree produces zero modifications (`git status` clean afterward) - `static/js/alpine.min.js` byte-identical before and after `make fmt` - first-party JS (`dashboard.js`, `deployment.js`, `utils.js`) is still formatted - lands via PR from a feature branch off `main`
clawbot added this to the 1.1.0 milestone 2026-08-07 18:47:54 +02:00
clawbot commented 2026-09-03 18:29:27 +02:00
Author
Collaborator
Copy Link

Confirmed still open — and the damage is already committed to main

Re-verified on 2026-09-03. There is still no .prettierignore, and script/fmt still passes the bare glob:

npx prettier --write --tab-width 4 static/js/*.js

Important detail this issue did not capture: the rewrite has already happened and was merged. It landed in 594537e ("rework: address review feedback on PR #126", 2026-02-22), where it was recorded innocuously as "Fix pre-existing JS formatting (prettier)":

before 594537e on main today
lines 5 3046
bytes 45,764 94,835

The vendored Alpine.js bundle was un-minified in place and is now 2.07x its original size. Since static/js/alpine.min.js is served to browsers, this is not just a hygiene problem — every user of the dashboard has been downloading ~49 KB of unnecessary bytes for six months, and the file named .min.js is no longer minified.

This changes the remediation

Adding .prettierignore alone is necessary but not sufficient — it would only freeze the corrupted file in place. The fix must also restore the artifact:

  1. Add .prettierignore covering static/js/*.min.js (at minimum static/js/alpine.min.js).
  2. Confirm prettier honours the ignore file when paths are passed explicitly — it historically did not without --ignore-path. If it does not, narrow the glob in script/fmt instead of relying on the ignore file. Verify by actually running make fmt twice on a clean tree.
  3. Re-vendor the genuine minified alpine.min.js at the pinned upstream version and record that version + date in a comment or static/js/README, per REPO_POLICIES.md pinning rules. Do not attempt to re-minify the expanded copy — fetch the real upstream artifact.
  4. Add the byte-size expectation to the DoD so a future formatter pass cannot silently re-expand it.

Existing DoD bullets all still apply; bullet 2 ("byte-identical before and after make fmt") should be read against the restored file, not the current one.

## Confirmed still open — and the damage is already committed to `main` Re-verified on 2026-09-03. There is still no `.prettierignore`, and `script/fmt` still passes the bare glob: ```sh npx prettier --write --tab-width 4 static/js/*.js ``` Important detail this issue did not capture: **the rewrite has already happened and was merged.** It landed in `594537e` ("rework: address review feedback on PR #126", 2026-02-22), where it was recorded innocuously as *"Fix pre-existing JS formatting (prettier)"*: | | before `594537e` | on `main` today | |---|---|---| | lines | 5 | 3046 | | bytes | 45,764 | 94,835 | The vendored Alpine.js bundle was un-minified in place and is now **2.07x its original size**. Since `static/js/alpine.min.js` is served to browsers, this is not just a hygiene problem — every user of the dashboard has been downloading ~49 KB of unnecessary bytes for six months, and the file named `.min.js` is no longer minified. ### This changes the remediation Adding `.prettierignore` alone is necessary but **not sufficient** — it would only freeze the corrupted file in place. The fix must also restore the artifact: 1. Add `.prettierignore` covering `static/js/*.min.js` (at minimum `static/js/alpine.min.js`). 2. Confirm prettier honours the ignore file **when paths are passed explicitly** — it historically did not without `--ignore-path`. If it does not, narrow the glob in `script/fmt` instead of relying on the ignore file. Verify by actually running `make fmt` twice on a clean tree. 3. **Re-vendor the genuine minified `alpine.min.js`** at the pinned upstream version and record that version + date in a comment or `static/js/README`, per `REPO_POLICIES.md` pinning rules. Do not attempt to re-minify the expanded copy — fetch the real upstream artifact. 4. Add the byte-size expectation to the DoD so a future formatter pass cannot silently re-expand it. Existing DoD bullets all still apply; bullet 2 ("byte-identical before and after `make fmt`") should be read against the *restored* file, not the current one.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
bug
Something is not working
 duplicate
This issue or pull request already exists
 enhancement
New feature
 help wanted
Need some help
 invalid
Something is wrong
 merge-ready
All checks pass, reviewed, rebased, ready for merge
 needs-checks
make check does not pass cleanly
 needs-rebase
PR has merge conflicts or is behind main
 needs-review
Code review not yet done
 needs-rework
Code review found issues to fix
 notplanned
question
More information is needed
 wontfix
This won't be fixed
No Label
Milestone
No items
No Milestone 1.1.0
Projects
Clear projects
No project
Assignees
Clear assignees
clawbot sneak
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: sneak/upaas#185
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?