Hacktoberfest 2026：維護者為十月標記出來的 issue，仍然開放、適合新手。 瀏覽 Hacktoberfest issue

A task input for its package's locked dependencies, so a lockfile edit misses only the tasks whose dependencies moved

未關閉
  • 哪裡不對？
#876 0 則留言 0 個 reaction 已指派 0 人 在 GitHub 檢視

維護者通常 1 天內回覆

還沒有人認領這個 Issue。

評估

難度
5/5
預估耗時
一週以上
新手友好度
28/100
Issue 類型
功能
描述清晰度
描述清楚
活躍度
活躍
技術堆疊
rust, yaml
領域
build-system, tooling

研究方向

Start with the cache input handling and lockfile parsing paths; the issue does not name source files or tests, so locate those entry points first. Read the existing input documentation and inspect how task fingerprints are built, then trace how workspace lockfile entries represent transitive, peer-qualified, optional, and workspace dependencies. Done means a declared input hashes only the task package's resolved dependency closure and fails when a required lockfile entry is missing.

由索引模型根據 Issue 內容生成。

描述

Written by an AI agent (Claude) on behalf of @jasonkuhrt.

Summary

A cached task cannot say "I depend on my package's installed dependencies" in a way that is both correct and stable. Each setting available today either replays a stale result or misses for a change the task never depended on.

This asks for one more input kind: a hash of the task's own package's resolved dependency closure, read from the lockfile. Turborepo has the same thing as each task's external_deps_hash.

What happens today

Two packages. a depends on is-odd through the catalog, and b depends on left-pad.

# pnpm-workspace.yaml
packages:
  - packages/*
catalog:
  is-odd: 3.0.1

// packages/a/package.json
{ "name": "a", "type": "module", "dependencies": { "is-odd": "catalog:" } }
// packages/b/package.json
{ "name": "b", "type": "module", "dependencies": { "left-pad": "1.3.0" } }

// packages/a/build.mjs
import isOdd from 'is-odd';
console.log('a built', isOdd(3));

// packages/a/vite.config.ts
import { defineConfig } from 'vite-plus';

export default defineConfig({
  run: {
    tasks: {
      build: { command: 'node build.mjs', cache: { input: INPUT } },
      check: { command: 'vp lint build.mjs', cache: { input: [{ auto: true }] } },
    },
  },
});

Each run below starts from a warm cache, then makes one change and runs vp install (vp 1.3.0, pnpm 10.18.0, macOS):

INPUT Change Result
[{ auto: true }], the default vp install --force, which changes nothing check: cache miss: 'node_modules/.modules.yaml' modified
[{ auto: true }, '!node_modules/**'], the docs' example catalog is-odd: 3.0.1 → 2.0.0 build: cache hit, replaying output built against is-odd 3.0.1
the docs' example plus { pattern: 'pnpm-lock.yaml', base: 'workspace' } b's left-pad 1.3.0 → 1.2.0 build: cache miss: 'pnpm-lock.yaml' modified
  • Default: tracking is exact for a plain script: build replays after b's bump and misses after a's. But any command that loads a config reads pnpm's install metadata, so it misses after every reinstall (voidzero-dev/vite-plus#2845).
  • Excluding node_modules: this takes dependencies out of the key entirely. A task's fingerprint is its cwd, program, args and envs (SpawnFingerprint), with no dependency component.
  • Naming the lockfile: this puts dependencies back, but as one file for the whole workspace. Every task that names it misses on every lockfile edit.

In our monorepo (138 packages), build-like tasks use the third setting. Over one week, 2,011 of the 4,673 misses whose reason was pnpm-lock.yaml (43%) were for packages whose resolved dependencies had not changed.

Proposal

A declared input whose content is the task's package's resolved dependency closure. Shape and name are yours to pick; for example:

cache: { input: [{ auto: true }, '!node_modules/**', { dependencies: 'locked' }] }

The closure is what the package's lockfile entry reaches:

  • each dependency's specifier and resolved version;
  • transitively, every resolved package those reach, including peer-qualified variants and optional dependencies;
  • workspace dependencies, followed through their own lockfile entries;
  • the catalog, override and patch entries that reach any of them.

With that input, b's bump replays a's build and the catalog bump misses it. A lockfile entry the closure needs but cannot find should fail the run, not silently hash less.

Prior art
  • Turborepo adds external_deps_hash to each task's hash (turborepo-hash). It computes the value from per-package closures (all_transitive_closures) for npm, pnpm, Yarn and Bun lockfiles.
  • Nx hashes the versions of the external packages a project's source imports, and its externalDependencies input adds the tools a command runs (docs).
How we work around it

We built this outside Vite Task:

  1. A pnpm-lock.yaml parser computes each package's closure by the rules above.
  2. A root task writes one hash file per package.
  3. Each task depends on that root task and declares its own package's hash file as an input.

It works, but every consumer needs an extra dependency edge, and every workspace that wants this has to re-implement the lockfile's semantics. We're happy to share the closure rules, or to open a PR if you want this approach.

主要語言
Rust
星號
478
分支
48
平均合併
1 天 5 小時
30 天內合併 PR
65

環境準備

在 Codespaces 中開啟

在瀏覽器裡用你自己的 GitHub 帳號啟動這個專案的開發容器。

  • 沒有 Dockerfile 或 Docker Compose 檔案
  • 沒有 Pull Request 範本
  • 閱讀貢獻指南

從這裡開始

  1. 先讀完整個 Issue，再讀專案的貢獻指南。
  2. 在 Issue 下留言說明你要接手 —— 這能避免兩個人做同樣的事。
  3. Fork 儲存庫，在一個分支上完成修改。
  4. 送出 Pull Request，並在描述裡引用這個 Issue 編號。

voidzero-dev/vite-task 的其他 Issue

查看 voidzero-dev/vite-task 的全部 Issue

相似的 Issue

更多 Rust Issue

把新 issue 寄到你的電子郵件信箱

精選適合新手參與的 GitHub issue 摘要。