Hi all,
A cold yarn install in architect-html pulls in Cypress and starts downloading its binary from download.cypress.io. Cypress appears nowhere in architect-html/package.json or yarn.lock - it arrives indirectly.
The chain:
architect-html depends on “@origam/react-contexify”: “github:origam/origam-react-contexify#v6.0.1-origam.0” - a git dependency, not a registry package.
Yarn Berry has to prepare git dependencies. It clones the repo into a temp folder and runs yarn pack --install-if-needed there, which performs a full install of that project - devDependencies included - and then runs its prepare script (tsup && yarn run build:style).
The fork’s devDependencies contain “cypress”: “^11.0.1”, used by its test script. Cypress’s postinstall then fetches the binary.
Why I think it’s worth addressing:
It bypasses the install hardening in architect-html. .yarnrc.yml there sets enableScripts: false and npmMinimalAgeGate: ‘7d’, but Yarn passes only process.env (plus COREPACK_ENABLE_AUTO_PIN and YARN_ENABLE_INLINE_BUILDS) into that nested run - the settings are not propagated. The clone installs with its own config, so lifecycle scripts execute normally.
Supply chain surface. A large dependency tree is installed and its install scripts run on every developer machine and CI runner, plus a sizeable binary is fetched over the network at install time - all for a test suite that is never shipped and, as far as I can tell, never executed as part of our build.
Cost. Cold installs and CI pay the download and the build every time the cache is empty or the pinned ref changes.
Cypress 11 dates back to 2022, so those transitive dependencies are unlikely to be getting fixes.
Options, roughly in order of preference:
Publish the fork as a prebuilt package (npm, or a tarball attached to a GitHub release) and depend on that instead of github:. This removes the prepare step entirely - no clone, no nested install, no build on developer machines.
Drop Cypress from the fork. If the component suite isn’t being run on origam/origam-react-contexify, removing cypress and the test / cypress:open scripts from devDependencies fixes it at the source.
Add .yarnrc.yml with enableScripts: false to the fork as a minimal stopgap - the binary download stops, though the dependency tree is still resolved and installed.
CYPRESS_INSTALL_BINARY=0 yarn install works around it locally (the env var does reach the nested install), but it has to be remembered on every machine and CI job, so it isn’t a real fix.
Thanks!