From 174fd47973c1a49474bb207d10dd33370a32c612 Mon Sep 17 00:00:00 2001 From: Tim van der Meij Date: Sun, 12 Jul 2026 16:27:17 +0200 Subject: [PATCH 1/3] Run all tests if `package-lock.json` changes If one of our dependencies changes it can have an effect on all tests we have, for instance via the test runner, bundler or coverage collector. This commit therefore updates all workflows that work with a file-based allowlist to also trigger on `package-lock.json` changes so that we have more certainty that any unintended effects of dependency updates can't go by unnoticed, and thus improve stability. --- .github/workflows/coverage_browser_tests.yml | 2 ++ .github/workflows/font_tests.yml | 2 ++ .github/workflows/integration_tests.yml | 2 ++ .github/workflows/publish_coverage_index.yml | 1 + .github/workflows/unit_tests.yml | 2 ++ 5 files changed, 9 insertions(+) diff --git a/.github/workflows/coverage_browser_tests.yml b/.github/workflows/coverage_browser_tests.yml index 5820c9f4d..fdf08e453 100644 --- a/.github/workflows/coverage_browser_tests.yml +++ b/.github/workflows/coverage_browser_tests.yml @@ -4,6 +4,7 @@ on: paths: - 'gulpfile.mjs' - 'external/**' + - 'package-lock.json' - 'src/**' - 'test/images/**' - 'test/pdfs/**' @@ -21,6 +22,7 @@ on: paths: - 'gulpfile.mjs' - 'external/**' + - 'package-lock.json' - 'src/**' - 'test/images/**' - 'test/pdfs/**' diff --git a/.github/workflows/font_tests.yml b/.github/workflows/font_tests.yml index 6c0da8a70..da185ed63 100644 --- a/.github/workflows/font_tests.yml +++ b/.github/workflows/font_tests.yml @@ -4,6 +4,7 @@ on: paths: - 'gulpfile.mjs' - 'external/**' + - 'package-lock.json' - 'src/**' - 'test/test.mjs' - 'test/font/**' @@ -14,6 +15,7 @@ on: paths: - 'gulpfile.mjs' - 'external/**' + - 'package-lock.json' - 'src/**' - 'test/test.mjs' - 'test/font/**' diff --git a/.github/workflows/integration_tests.yml b/.github/workflows/integration_tests.yml index cbd67ccb4..d003580be 100644 --- a/.github/workflows/integration_tests.yml +++ b/.github/workflows/integration_tests.yml @@ -4,6 +4,7 @@ on: paths: - 'gulpfile.mjs' - 'external/**' + - 'package-lock.json' - 'src/**' - 'test/test.mjs' - 'test/integration/**' @@ -15,6 +16,7 @@ on: paths: - 'gulpfile.mjs' - 'external/**' + - 'package-lock.json' - 'src/**' - 'test/test.mjs' - 'test/integration/**' diff --git a/.github/workflows/publish_coverage_index.yml b/.github/workflows/publish_coverage_index.yml index e28705f1d..df5fd184d 100644 --- a/.github/workflows/publish_coverage_index.yml +++ b/.github/workflows/publish_coverage_index.yml @@ -12,6 +12,7 @@ on: paths: - 'gulpfile.mjs' - 'external/**' + - 'package-lock.json' - 'src/**' - 'test/images/**' - 'test/pdfs/**' diff --git a/.github/workflows/unit_tests.yml b/.github/workflows/unit_tests.yml index e5d36113c..fc97a847d 100644 --- a/.github/workflows/unit_tests.yml +++ b/.github/workflows/unit_tests.yml @@ -4,6 +4,7 @@ on: paths: - 'gulpfile.mjs' - 'external/**' + - 'package-lock.json' - 'src/**' - 'test/test.mjs' - 'test/unit/**' @@ -15,6 +16,7 @@ on: paths: - 'gulpfile.mjs' - 'external/**' + - 'package-lock.json' - 'src/**' - 'test/test.mjs' - 'test/unit/**' From ebaa98b8541fcafc4b05a40d5971f30a799c7c52 Mon Sep 17 00:00:00 2001 From: Tim van der Meij Date: Sun, 12 Jul 2026 16:27:27 +0200 Subject: [PATCH 2/3] Run the font/Fluent linter tests if their Python requirements change The `requirements.txt` files of the two Python-based workflows were not included in the file-based allowlist, which prevented the font/Fluent linter tests from running if their contents changed. This commit fixes that oversight from the original introduction of the workflows. --- .github/workflows/fluent_linter.yml | 2 ++ .github/workflows/font_tests.yml | 2 ++ 2 files changed, 4 insertions(+) diff --git a/.github/workflows/fluent_linter.yml b/.github/workflows/fluent_linter.yml index b5a96b7fa..e419db8f3 100644 --- a/.github/workflows/fluent_linter.yml +++ b/.github/workflows/fluent_linter.yml @@ -4,6 +4,7 @@ on: paths: - 'l10n/en-US/**.ftl' - '.github/fluent_linter_config.yml' + - '.github/fluent_linter_requirements.txt' - '.github/workflows/fluent_linter.yml' branches: - master @@ -11,6 +12,7 @@ on: paths: - 'l10n/en-US/**.ftl' - '.github/fluent_linter_config.yml' + - '.github/fluent_linter_requirements.txt' - '.github/workflows/fluent_linter.yml' branches: - master diff --git a/.github/workflows/font_tests.yml b/.github/workflows/font_tests.yml index da185ed63..d00d6f690 100644 --- a/.github/workflows/font_tests.yml +++ b/.github/workflows/font_tests.yml @@ -8,6 +8,7 @@ on: - 'src/**' - 'test/test.mjs' - 'test/font/**' + - '.github/font_tests_requirements.txt' - '.github/workflows/font_tests.yml' branches: - master @@ -19,6 +20,7 @@ on: - 'src/**' - 'test/test.mjs' - 'test/font/**' + - '.github/font_tests_requirements.txt' - '.github/workflows/font_tests.yml' branches: - master From ae179be764b63623a6e6ee4ca300539c94eff5dc Mon Sep 17 00:00:00 2001 From: Tim van der Meij Date: Sun, 12 Jul 2026 16:27:31 +0200 Subject: [PATCH 3/3] Pin the full dependency trees of the font/Fluent linter test requirements The `requirements.txt` files of the two Python-based builds only listed the top-level dependency, and thus not the full dependency tree, and only limited it via a version range. This means that the actual versions we use for the builds are determined at runtime, and can thus easily change if a new version gets published. This causes the builds to not be deterministic, and it's in contrast to the JavaScript-based builds where `package-lock.json` pins the full dependency tree with fixed versions. This commit changes the `requirements.txt` files to follow the same approach as `package-lock.json` and thus pin the full dependency tree to fixed versions. This ensures deterministic builds, improves consistency and provides better protection against e.g. supply chain attacks by not automatically pulling in new versions as they are published (but rather make updating versions a conscious and verifiable/auditable action). To simplify the update process, and make it repeatable, we document the full one-line generation commands inline. --- .github/fluent_linter_requirements.txt | 8 +++++++- .github/font_tests_requirements.txt | 4 +++- 2 files changed, 10 insertions(+), 2 deletions(-) diff --git a/.github/fluent_linter_requirements.txt b/.github/fluent_linter_requirements.txt index 5f8b68c5b..564666d96 100644 --- a/.github/fluent_linter_requirements.txt +++ b/.github/fluent_linter_requirements.txt @@ -1 +1,7 @@ -moz-fluent-linter==0.4.* +# The requirements below can be regenerated with the following one-liner: +# `python3 -m venv venv; source venv/bin/activate; pip install -q moz-fluent-linter; pip freeze; deactivate; rm -rf venv` +fluent.syntax==0.19.0 +moz-fluent-linter==0.4.10 +PyYAML==6.0.3 +six==1.17.0 +typing_extensions==4.16.0 diff --git a/.github/font_tests_requirements.txt b/.github/font_tests_requirements.txt index e8ce6dfc4..e11be43ea 100644 --- a/.github/font_tests_requirements.txt +++ b/.github/font_tests_requirements.txt @@ -1 +1,3 @@ -fonttools==4.* +# The requirements below can be regenerated with the following one-liner: +# `python3 -m venv venv; source venv/bin/activate; pip install -q fonttools; pip freeze; deactivate; rm -rf venv` +fonttools==4.63.0