Skip to content

fix(#3208): disable Yarn npmMinimalAgeGate in run-e2e.sh - #3209

Open
fullsend-ai-coder[bot] wants to merge 1 commit into
mainfrom
agent/3208-yarn-agegate-quarantine
Open

fix(#3208): disable Yarn npmMinimalAgeGate in run-e2e.sh#3209
fullsend-ai-coder[bot] wants to merge 1 commit into
mainfrom
agent/3208-yarn-agegate-quarantine

Conversation

@fullsend-ai-coder

Copy link
Copy Markdown
Contributor

The generated .yarnrc.yml only set nodeLinker without configuring npmMinimalAgeGate. Yarn 4.17 defaults to a 24-hour quarantine (1440 minutes), causing YN0016 failures when any workspace dependency was published within the last 24 hours. Since run-e2e.sh deletes yarn.lock and resolves from scratch, every nightly e2e run was vulnerable to this.

Set npmMinimalAgeGate: 0 in the generated .yarnrc.yml to disable quarantine. This is appropriate because run-e2e.sh is a CI-only test runner where dependencies are author-pinned — the fresh resolution is an artifact of the workspace hoisting strategy, not a supply-chain trust boundary.


Closes #3208

Post-script verification

  • Branch is not main/master (agent/3208-yarn-agegate-quarantine)
  • Secret scan passed (gitleaks — f7ed7ed3ed8d163e3b191ca0f97cf46cb0e07a04..HEAD)
  • Pre-commit hooks passed (authoritative run on runner)
  • Tests ran inside sandbox

The generated .yarnrc.yml only set nodeLinker without configuring
npmMinimalAgeGate. Yarn 4.17 defaults to a 24-hour quarantine
(1440 minutes), causing YN0016 failures when any workspace
dependency was published within the last 24 hours. Since
run-e2e.sh deletes yarn.lock and resolves from scratch, every
nightly e2e run was vulnerable to this.

Set npmMinimalAgeGate: 0 in the generated .yarnrc.yml to disable
quarantine. This is appropriate because run-e2e.sh is a CI-only
test runner where dependencies are author-pinned — the fresh
resolution is an artifact of the workspace hoisting strategy,
not a supply-chain trust boundary.

Closes #3208
@openshift-ci

openshift-ci Bot commented Aug 7, 2026

Copy link
Copy Markdown

Hi @fullsend-ai-coder[bot]. Thanks for your PR.

I'm waiting for a redhat-developer member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@sonarqubecloud

sonarqubecloud Bot commented Aug 7, 2026

Copy link
Copy Markdown

Quality Gate Failed Quality Gate failed

Failed conditions
D Maintainability Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE

@github-actions github-actions Bot added the non-workspace-changes PR changes files outside workspace directories label Aug 7, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

needs-ok-to-test non-workspace-changes PR changes files outside workspace directories

Projects

None yet

Development

Successfully merging this pull request may close these issues.

run-e2e.sh should defend against Yarn npmMinimalAgeGate quarantine

0 participants