during build: Unable to resolve reference $tailwindcss

[tessus]

When building the web-vault, there is an error during the build, which seems unimportant, because the final web-vault works just fine.

However, it is also shown in the github action that runs to build the web-vault: https://github.com/dani-garcia/bw_web_builds/actions/runs/5842418493/job/15843518701#step:8:343

Here's the relevant part:

#20 [build 15/20] RUN npm audit fix || true
#20 10.12 npm ERR! Unable to resolve reference $tailwindcss
#20 10.12 
#20 10.12 npm ERR! A complete log of this run can be found in:
#20 10.12 npm ERR!     /home/node/.npm/_logs/2023-08-12T16_46_43_100Z-debug-0.log
#20 DONE 10.3s

When I run this locally, the debug file is gone, before I can check the contents.

This issue can be closed right away, I just wanted to mention it, in case you are not aware of this.

[stefan0xC]

As far as I've looked into it, upstream does not have that issue because they don't run npm audit fix during build. So maybe we should not either? (I mean the docker build continues because of the || true so we do skip it). If we want to actually run npm audit fix we could replace the $tailwindcss manually with the concrete version of the dependency (e.g. 3.3.2) or remove overrides.tailwindcss.

Not sure what else can be done about this. I mean this is probably a bug in npm/cli.

When I run this locally, the debug file is gone, before I can check the contents.

You could add --rm=false to the docker build command so the temporary container does not get removed and then you should be able to inspect the file. If you run the build manually it will be easier to see the error.
(I've attached an excerpt with the relevant traceback, if you are interested.)

[tessus]

I do not know what the best option here is. Does this mean that the entire npm audit failed and was rolled back, or does it only mean that tailwinds or the module that requires tailwinds was not updated/fixed?

Either way, if this project wants the npm audit to succeed, your 2 suggestions seem the only viable way.
If not, it can be left as is, since maybe it will be fixed automatically when the module maintainers change the dependencies.

You could add --rm=false to the docker build

I was actually using make full thus no docker, but when I tried to list the contents of the file (while the rest of the build process was still running), the file was no longer on my local disk. Weird.
I certainly could find a way to get this done, but often these debug files are rather useless.

[tessus]

Shall I close this issue or should I leave it open?

[stefan0xC]

I would leave it open so we have a place to discuss if and how we want to address this. Personally, I would probably opt to not use npm audit fix and I'd rather we follow upstream and just use the versions they have used.

I'm also not sure if we currently have the resources to actively maintain a fork of the web vault in case we want to keep dependencies up-to-date ourselves, but we could at least have a way (cf. #137) to keep track of such changes (which would be important for supply chain security).

Does this mean that the entire npm audit failed and was rolled back, or does it only mean that tailwinds or the module that requires tailwinds was not updated/fixed?

It means the former i.e. there are no packages updated because npm audit fix fails to even generate a new package tree.

I was actually using make full thus no docker, but when I tried to list the contents of the file (while the rest of the build process was still running), the file was no longer on my local disk. Weird.

Sorry, I was assuming you used docker because of the quoted RUN npm audit fix || true. You'll have to remove the || true from scripts/build_web_vault.sh so it stops there and you can inspect the file, because I think the next npm command probably deleted the file - not sure why though because npm says that it will delete the oldest log files first. (Maybe cleaning the _logs directory manually will solve the problem.)

[tessus]

I would leave it open

You got it.

It means the former

Thanks for the info.

I was assuming you used docker because of the quoted RUN npm audit fix || true.

Yeah, I thought that pointing to the error in the gh pipeline of this repo makes more sense than posting local info.

[AlexanderS]

This is fixed by using node18.x instead of node16.x. See the EBADENGINE warning here: https://github.com/dani-garcia/bw_web_builds/actions/runs/5842418493/job/15843518701#step:8:290

[stefan0xC]

@AlexanderS No. The EBADENGINE issue has been pointed out in #136 and has nothing to do with the error reported here. Building the project with node v18.17.1 will still fail if I remove the || true from the npm audit fix command.
Cf. the attached 2023-08-31T17_32_07_659Z-debug-0.log (or my previous excerpt with node v18.16.0).