test: use verdaccio for e2e init testing

[erickzhao]

Our init tests have a release blocking issue at the moment

Given:

• Our npm trusted publishing workflow relies on yarn lerna:version, which bumps all versions in Electron Forge to the next semantic release version without tagging or releasing.
• The git tag/npm release flow for this new release only gets triggered once the PR is merged.

Then:

• The init tests run against the current build of Forge. They will attempt to install an unreleased version for any version bump PR and the tests will fail.

For an example of this in action, see #4094.

Solution

Verdaccio is an npm proxy registry. This PR adds a new spawn-verdaccio.ts tool script that runs a new instance of the registry on localhost and runs the lerna publish command on Forge with the --registry flag pointing to Verdaccio.

Then, the script will attempt to run any command that it's fed through args with an additional set of environment variables to correctly point the package manager to Verdaccio (NPM_CONFIG_REGISTRY, YARN_NPM_REGISTRY_SERVER, YARN_UNSAFE_HTTP_WHITELIST).

Alternatives considered

Initially, I tried to modify initLink to point all Forge deps to file: protocol. This worked fine with npm, but fell apart a bit with Yarn and pnpm when dealing with the workspace: protocol (albeit I also tried to wire up local node_modules dependencies via file: protocol as well and that caused more issues).

In the end, I chose the Verdaccio solution since it's package manager-agnostic. It's not a perfect replacement for initLink since it doesn't respond to changes in the original JavaScript code (it just tarballs the dist folder), but works well in tests and CI.

Caveats

• Running lerna publish (even to Verdaccio) requires a clean working tree, so you'll need to commit all changes before running yarn test:verdaccio. Any tests that leave committable artifacts will also mess up the Verdaccio tests because Lerna will be unable to publish.
  • For example, running yarn config set dynamically in CI will cause these tests to fail because it modifies .yarnrc.yml on the fly.
• Only the init tests currently run against Verdaccio, but there might be room in the future to do so with other tests that install deps (e.g. TypeScript template tests).

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	verdaccio@​6.2.4

View full report

[socket-security]

All alerts resolved. Learn more about Socket for GitHub.

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

Ignoring alerts on:

• jws@3.2.3

View full report

[erickzhao]

Note that this PR is also blocking releases in main, so I'll be backporting the work shortly.

[erickzhao]

@SocketSecurity ignore npm/jws@3.2.3 seems fine