chore: Pass 2 — aggressive public-surface trim of all 4 osl-* forks#108
Draft
bjcorder wants to merge 1 commit into
Draft
chore: Pass 2 — aggressive public-surface trim of all 4 osl-* forks#108bjcorder wants to merge 1 commit into
bjcorder wants to merge 1 commit into
Conversation
…i override
Pass 2 of the Ozark stdlib pilot — public-surface trim across all four
forks. Each fork's exported surface is now reduced to what
deterministic-deps actually consumes, with internal class methods
trimmed where they were isolated from the kept surface.
osl-actions-core (23007f6 → d0839bc)
- 28 exports → 6: getInput, setOutput, warning, setFailed, summary,
ExitCode.
- Deleted src/oidc-utils.ts, src/platform.ts, src/path-utils.ts.
- Summary class trimmed from 14 methods to 4 (addHeading, addRaw,
addEOL, write + private helpers).
- Inlined error() into setFailed().
- Runtime dependencies dropped from 2 (@actions/exec,
@actions/http-client) to 0.
- Source LOC: 1,192 → 407 (66% reduction).
osl-glob (3d32991 → b1bf03d)
- 18 exports → 1: just the async glob() function.
- Dropped globStreamSync/globStream/globSync/globIterateSync/
globIterate + their stream/iterate/sync aliases + the Object.assign
cluster.
- Glob class methods walkSync/stream/streamSync/iterate/iterateSync
plus Symbol.iterator/asyncIterator implementations removed.
- GlobStream class removed from walker.ts.
- Source LOC: 2,116 → 1,833 (13%).
osl-js-yaml (721957e → b04ff4f)
- 15 exports → 4: load, loadAll, DEFAULT_SCHEMA, YAMLException.
- Deleted lib/dumper.js (~965 LOC) and the CLI binary.
- Removed the entire `types` registry export, dump/safe* shims, and
named schemas other than DEFAULT_SCHEMA (the underlying files stay
because DEFAULT_SCHEMA depends on them).
- Runtime dependencies dropped from 1 (argparse) to 0.
osl-minimatch (4a0ff5b → 6e49846)
- 10 exports → 3 + 6 type-only: Minimatch class, sep, GLOBSTAR.
- Dropped top-level helpers: minimatch(), filter, defaults, makeRe,
match. All minimatch.X = X attached properties removed. Static
Minimatch.defaults removed.
- Deleted src/escape.ts. Removed escape/unescape/AST re-exports.
- Source LOC: 2,721 → 2,561 (6% — the Minimatch class is the core).
Consumer impact:
- dist/index.js: 1,733 KB → 397 KB (77% reduction in the production
bundle). Driven mainly by the dropped @actions/core OIDC code path
(pulled in @actions/http-client + undici through the override) and
lib/dumper.js.
- Removed dead `overrides.undici` from package.json — the node/
lockfile-coverage rule correctly caught the orphaned override on
the first dogfood after the SHA bumps, since undici has no consumer
in the dep graph after the OIDC trim.
- All 157 tests pass. Lint, format, whitespace, dogfood all clean.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Pass 2 of the Ozark internal-stdlib pilot. Each of the four runtime-dep forks now exposes only the surface
deterministic-depsactually consumes; the rest of upstream's public API has been deleted from the fork.Per-fork trim summary
23007f6→d0839bcgetInput,setOutput,warning,setFailed,summary,ExitCode)src/oidc-utils.ts,src/platform.ts,src/path-utils.ts. TrimmedSummaryclass to 4 methods. Dropped runtime deps@actions/exec+@actions/http-client(no longer reachable). Source LOC 1,192 → 407.3d32991→b1bf03dglob())Globclass methodswalkSync/stream/streamSync/iterate/iterateSync. RemovedGlobStreamclass fromwalker.ts. Source LOC 2,116 → 1,833.721957e→b04ff4fload,loadAll,DEFAULT_SCHEMA,YAMLException)lib/dumper.jsentirely (~965 LOC) plus the CLI binary, browser bundles, examples/support/benchmark dirs, andargparseruntime dep.4a0ff5b→6e49846Minimatchclass,sep,GLOBSTAR)minimatch/filter/defaults/makeRe/matchhelpers. RemovedMinimatch.defaultsstatic + allminimatch.X = Xchained properties. Deletedsrc/escape.ts.Bundle impact
dist/index.jsshrinks from 1,733 KB → 397 KB (77% reduction). Most of the drop comes from:@actions/coreOIDC code path (pulled in@actions/http-client+undicithrough theoverridesblock).js-yaml's entire serializer (lib/dumper.js).Self-discovered finding
After bumping the SHAs the first time, the dogfood scan emitted a single new finding:
node/lockfile-coveragecomplaining thatoverrides.undici(inpackage.json) had no lockfile entry with integrity metadata. This was correct —undicihad no consumer in the dep graph anymore (its only path was through the deleted OIDC code). Removed the dead override; dogfood goes back to 0 findings. The rule worked.Verification
npm run all: lint + 157 tests + tsc + ncc bundle — green.npm run format: clean.git diff --check: clean.node dist/index.js: 0 findings.Test plan
package.jsonmatch the index at https://github.com/Ozark-Security-Labs/.github/blob/main/docs/ozark-stdlib.md.OZARK-NOTES.mdandCHANGELOG-OZARK.mdPass 2 entries — they document exactly what was removed and why.