metamask-extension/.circleci/scripts/validate-allow-scripts.sh

#!/usr/bin/env bash

set -e
set -u
set -o pipefail

yarn allow-scripts auto

if git diff --exit-code --quiet
then
  echo "allow-scripts configuration is up-to-date"
else
  echo "allow-scripts configuration requires updates"
  exit 1
fi
Add CI check to ensure LavaMoat policy is updated (#10493) A CI job has been added to ensure the `allow-scripts` config and the LavaMoat auto-generated policy is up-to-date. This will only run on release branches and the `master` branch, because it's too difficult a requirement to meet for each PR for contributors on macOS, due to differences in the dependency graph caused by optional dependencies. The `allow-scripts` and LavaMoat policy have both been updated using `yarn allow-scripts auto` and `yarn lavamoat:auto`. 2021-02-24 16:52:28 +01:00			`#!/usr/bin/env bash`

			`set -e`
			`set -u`
			`set -o pipefail`

			`yarn allow-scripts auto`

Fix LavaMoat config check (#10514) The CI script to ensure no LavaMoat policy changes are required has been failing despite there being no changes. It turns out that the command used to check for changes (`git diff-index`) was failing despite the lack of changes because the file was written again by `yarn lavamoat:auto` but git hadn't gotten around to updating its index since the write occurred, so it was considering it as changed until it verified it wasn't [1]. The command has been replaced by `git diff --exit-code --quiet`, which should do exactly the same thing except that it forces git to update its internal cache to verify whether changes are present. [1]: https://stackoverflow.com/questions/34807971/why-does-git-diff-index-head-result-change-for-touched-files-after-git-diff-or-g 2021-02-25 15:43:47 +01:00			`if git diff --exit-code --quiet`
Add CI check to ensure LavaMoat policy is updated (#10493) A CI job has been added to ensure the `allow-scripts` config and the LavaMoat auto-generated policy is up-to-date. This will only run on release branches and the `master` branch, because it's too difficult a requirement to meet for each PR for contributors on macOS, due to differences in the dependency graph caused by optional dependencies. The `allow-scripts` and LavaMoat policy have both been updated using `yarn allow-scripts auto` and `yarn lavamoat:auto`. 2021-02-24 16:52:28 +01:00			`then`
			`echo "allow-scripts configuration is up-to-date"`
			`else`
			`echo "allow-scripts configuration requires updates"`
			`exit 1`
			`fi`