mirror of
https://github.com/getpaseo/paseo.git
synced 2026-10-27 19:52:49 +00:00
Mohamed Boudra
26ee20b371
`npm audit signatures` in the quality job fails on some runners with EMISSINGSIGNATUREKEY for @react-native/babel-preset@0.88.0. Nothing in the repo uses React Native 0.88: the package came from a second Expo SDK that npm placed under packages/expo-two-way-audio/node_modules because expo-module-scripts was declared there. Root `overrides` are not applied to packages nested under a workspace, so jest-expo's `expo@*` peer resolved to the latest SDK and pulled 200+ duplicate packages into the lockfile. The failure itself is a CDN cache problem: one Cloudflare edge (ORD, which serves GitHub runners in Azure northcentralus) cached the attestations document for that version seconds after publish, before the publish attestation existed, and keeps serving the provenance-only document for a year. Every quality job that lands in that region fails; every other region passes. The audit code path checks the registry signature before attestations, so the key list is fine and reruns only succeed by landing elsewhere. Declaring expo-module-scripts in the root devDependencies puts it under the overrides, which removes the nested SDK and the poisoned URL from the lockfile. The module's tsconfig points its typeRoots at the hoisted copy; its scripts resolve `expo-module` from the root `.bin`. Closes #7730