From 4025ccc6dca09353bed88f572324924225ce186d Mon Sep 17 00:00:00 2001
From: Mark Stacey <markjstacey@gmail.com>
Date: Mon, 11 Nov 2024 18:23:21 -0330
Subject: [PATCH] fix: Fix attribution generation

Fix the `attribution:generate` command by ensuring that it is possible
to install just production dependencies.

Previously the command `yarn workspaces focus --production` (used to
discard development dependencies, keeping just production dependencies
installed) would fail because `rimraf` was not found. `rimraf` was a
development dependency used in the `postinstall` script. This was
resolved by replacing `rimraf` with a Node.js script that does the
same thing without needing any dependency.

Once that failure was resolved, another was revealed. The
`allow-scripts` step of the installation began failing because there
was a package detected that had an install script that was missing from
our configuration. This package was in our configuration already, but
the `allow-scripts` configuration is sensitive to changes in the
directory structure of `node_modules`, and that structure changed due
to differences in which packages were hoisted in the production-only
install.

That failure was resolved by updating `generate-attributions.sh` to
remove the `allow-scripts` plugin while generating attributions. We
don't need `postinstall` scripts to run in order to read licences from
disk.

Fixes #28412
---
 development/clear-webpack-cache.js   | 26 ++++++++++++++++++++++++++
 development/generate-attributions.sh |  7 +++++++
 package.json                         |  2 +-
 3 files changed, 34 insertions(+), 1 deletion(-)
 create mode 100755 development/clear-webpack-cache.js

diff --git a/development/clear-webpack-cache.js b/development/clear-webpack-cache.js
new file mode 100755
index 000000000000..c6435b59a0e0
--- /dev/null
+++ b/development/clear-webpack-cache.js
@@ -0,0 +1,26 @@
+#!/usr/bin/env node
+
+const fs = require('node:fs/promises');
+const path = require('node:path');
+
+const WEBPACK_CACHE_DIRECTORY = path.resolve(
+  __dirname,
+  '..',
+  'node_modules',
+  '.cache',
+  'webpack',
+);
+
+/**
+ * Clear the Webpack cache.
+ *
+ * This is typically run in the `postinstall` npm/Yarn lifecycle script.
+ */
+async function main() {
+  await fs.rm(WEBPACK_CACHE_DIRECTORY, { force: true, recursive: true });
+}
+
+main().catch((error) => {
+  console.error(error);
+  process.exitCode = 1;
+});
diff --git a/development/generate-attributions.sh b/development/generate-attributions.sh
index 6d4b335430e2..e1b282148295 100755
--- a/development/generate-attributions.sh
+++ b/development/generate-attributions.sh
@@ -27,6 +27,13 @@ main() {
   # relative to the project root irrespective of where this script was run.
   cd "${PROJECT_DIRECTORY}"
 
+  # Remove allow-scripts plugin.
+  # Allow-scripts won't run correctly after a production-only install because the configuration
+  # includes exact paths to each dependency, and those paths can change in a production-only
+  # install because of the hoisting algorithm.
+  # We don't need postinstall scripts to run in order to generate attributions anyway.
+  yarn plugin remove @yarnpkg/plugin-allow-scripts
+
   # Instruct Yarn to only install production dependencies
   yarn workspaces focus --production
 
diff --git a/package.json b/package.json
index 39a5bb13b596..d3be692fb0f9 100644
--- a/package.json
+++ b/package.json
@@ -8,7 +8,7 @@
   },
   "scripts": {
     "webpack": "tsx ./development/webpack/launch.ts",
-    "webpack:clearcache": "rimraf node_modules/.cache/webpack",
+    "webpack:clearcache": "./development/clear-webpack-cache.js",
     "postinstall": "yarn webpack:clearcache",
     "env:e2e": "SEGMENT_HOST='https://api.segment.io' SEGMENT_WRITE_KEY='FAKE' yarn",
     "start": "yarn build:dev dev --apply-lavamoat=false --snow=false",