Skip to content

Vendor acquisition-sdk instead of depending on the code-push npm package - #9

Merged
ofalvai merged 1 commit into
masterfrom
push-optovlvxomwp
Jul 31, 2026
Merged

Vendor acquisition-sdk instead of depending on the code-push npm package#9
ofalvai merged 1 commit into
masterfrom
push-optovlvxomwp

Conversation

@ofalvai

@ofalvai ofalvai commented Jul 29, 2026

Copy link
Copy Markdown
Collaborator

Summary

Vendors the acquisition-sdk (server-communication layer) directly into this repo instead of depending on the archived code-push npm package, dropping that package and its superagent/proxy-agent/vm2 dependency chain entirely.

Decisions

  • Drop X-CodePush-SDK-Version header, only report X-CodePush-Plugin-Version: we are okay with it on the server side, the version of the acquisition-sdk is not relevant, especially after vendoring it.

  • Vendor relevant files 1:1, do not fix bugs or make refactors.

  • Vendor relevant test files too, without running them: we still don't have a proper unit test setup in this project (only E2E tests), and I think that's outside the scope of this PR. Once we set up unit testing, these vendored tests become runnable.

  • Since acquisition-sdk is written in TS, and the runtime part of CodePush is still in JS, this PR introduces a TS -> JS transpilation step (build:ts NPM script). Alternatives considered:

    • Rewrite acquisition-sdk to JS and vendor that: this would go against our plans to convert JS in this repo to TS
    • Do the transpilation once and check the result (.js, .d.ts and .js.map files) into git: too easy to forget to do it after code changes.
  • This transpilation is hooked into NPM's prepare script. prepare runs at both npm install and npm publish (unlike the prepack hook). This ensures a consistent dir layout with the right generated JS files in both the local env and in CI.

  • This build split is intentionally temporary: tsconfig.build.json (for src/lib/) exists separately from tsconfig.json (for test/bin/) only because acquisition-sdk is the sole part of the runtime migrated to TypeScript so far. Once CodePush.js and the rest of the runtime JS move to TS, these should collapse into one build — and adopting a common tool like react-native-builder-bob instead of hand-rolled tsc + npm script wiring is worth reconsidering at that point.

@ofalvai
ofalvai force-pushed the push-optovlvxomwp branch 4 times, most recently from 61e7e38 to 3779b2e Compare July 31, 2026 07:37
@bitrise-io bitrise-io deleted a comment from coderabbitai Bot Jul 31, 2026
@ofalvai
ofalvai force-pushed the push-optovlvxomwp branch 3 times, most recently from bbc0ffc to de0b597 Compare July 31, 2026 08:39
@bitrise-io bitrise-io deleted a comment from coderabbitai Bot Jul 31, 2026
@ofalvai
ofalvai marked this pull request as ready for review July 31, 2026 08:42
@coderabbitai

coderabbitai Bot commented Jul 31, 2026

Copy link
Copy Markdown

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 9da197ac-6304-480a-b3ff-f5c1fbc3ba0b

📥 Commits

Reviewing files that changed from the base of the PR and between de0b597 and 98c82dd.

⛔ Files ignored due to path filters (1)
  • package-lock.json is excluded by !**/package-lock.json
📒 Files selected for processing (13)
  • .gitignore
  • .npmignore
  • CLAUDE.md
  • CodePush.js
  • package.json
  • request-fetch-adapter.js
  • src/acquisition-sdk/__tests__/acquisition-rest-mock.ts
  • src/acquisition-sdk/__tests__/acquisition-sdk.test.ts
  • src/acquisition-sdk/acquisition-sdk.ts
  • src/acquisition-sdk/code-push-error.ts
  • src/acquisition-sdk/types.ts
  • tsconfig.build.json
  • tsconfig.json
🚧 Files skipped from review as they are similar to previous changes (13)
  • .gitignore
  • CodePush.js
  • src/acquisition-sdk/code-push-error.ts
  • tsconfig.json
  • src/acquisition-sdk/types.ts
  • request-fetch-adapter.js
  • .npmignore
  • CLAUDE.md
  • package.json
  • tsconfig.build.json
  • src/acquisition-sdk/tests/acquisition-sdk.test.ts
  • src/acquisition-sdk/acquisition-sdk.ts
  • src/acquisition-sdk/tests/acquisition-rest-mock.ts

Walkthrough

Added a vendored TypeScript Acquisition SDK with update checks, status reporting, HTTP handling, validation, and CodePush-specific errors. Added mock-backed SDK tests. Updated TypeScript build configuration and package scripts to emit lib/. Updated runtime imports, removed the code-push dependency, and excluded source and development files from npm packages.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (4 passed)
Check name Status Explanation
Title check ✅ Passed The title clearly summarizes the primary change: vendoring acquisition-sdk and removing reliance on the code-push npm package.
Description check ✅ Passed The description accurately explains the vendored SDK, build changes, dependency removal, header change, and testing scope.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.

Comment @coderabbitai help to get the list of available commands.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 3

🧹 Nitpick comments (5)
src/acquisition-sdk/__tests__/acquisition-sdk.test.ts (1)

266-266: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Remove the duplicated assignment.

acquisition = acquisition = new ... assigns twice.

🧹 Proposed fix
-            acquisition = acquisition = new acquisitionSdk.AcquisitionManager(new mockApi.CustomResponseHttpRequester(invalidJsonResponse), configuration);
+            acquisition = new acquisitionSdk.AcquisitionManager(new mockApi.CustomResponseHttpRequester(invalidJsonResponse), configuration);
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/acquisition-sdk/__tests__/acquisition-sdk.test.ts` at line 266, Remove
the duplicated assignment in the AcquisitionManager setup so the acquisition
variable is assigned to the new AcquisitionManager instance only once.
src/acquisition-sdk/acquisition-sdk.ts (2)

216-216: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Replace the arguments-based callback reassignment.

This line assigns false to callback when the last argument is not a function, which contradicts the declared Callback<void> type and relies on arguments inside a class method. The declared callback parameter already carries the value. Removing the line keeps behavior for all documented call shapes and improves readability.

♻️ Proposed refactor
-        callback = typeof arguments[arguments.length - 1] === "function" && arguments[arguments.length - 1];
-
         this._httpRequester.request(Http.Verb.POST, url, JSON.stringify(body), (error: Error, response: Http.Response): void => {
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/acquisition-sdk/acquisition-sdk.ts` at line 216, Remove the
arguments-based reassignment of callback in the acquisition method, keeping the
declared callback parameter unchanged. Preserve the existing handling for all
documented call shapes without introducing a false value or relying on
arguments.

143-145: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Pass an explicit null error instead of the outer error variable.

The error identifier here resolves to the requester callback parameter from Line 117, which is already known to be falsy. The catch binding at Line 138 is not in scope. The current code reads as if it forwards a parse error, but it always reports "no update". Make the intent explicit.

♻️ Proposed refactor
             if (!updateInfo) {
-                callback(error, /*remotePackage=*/ null);
+                callback(/*error=*/ null, /*remotePackage=*/ null);
                 return;
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/acquisition-sdk/acquisition-sdk.ts` around lines 143 - 145, Update the
!updateInfo branch in the acquisition request callback to pass an explicit null
error to callback, preserving the null remotePackage argument and early return.
Do not use the outer error parameter, since this path represents no available
update rather than a parsing failure.
src/acquisition-sdk/__tests__/acquisition-rest-mock.ts (2)

76-89: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Server.onAcquire is dead code.

No caller references onAcquire. It also uses field names that no longer match the SDK contract (params.deploymentKey, isAvailable), so it would mislead a future reader who wires these tests into a runner. Consider removing it during the port.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/acquisition-sdk/__tests__/acquisition-rest-mock.ts` around lines 76 - 89,
Remove the unused Server.onAcquire method from the acquisition REST mock; no
callers reference it, and its outdated deploymentKey/isAvailable contract should
not remain as misleading dead code.

9-32: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Mutable module-level exports depend on CommonJS output.

Tests reassign mockApi.serverUrl and mockApi.latestPackage through a namespace import. That works with CommonJS emit, but native ES modules make namespace properties read-only, so the assignment throws in strict mode. If the future test runner uses native ESM, replace these export var bindings with exported setter functions.

As per path instructions, tests under src/acquisition-sdk/__tests__/ are reference tests and are not wired into a runner yet, so this is a note for the runner work rather than a blocker.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/acquisition-sdk/__tests__/acquisition-rest-mock.ts` around lines 9 - 32,
Replace the mutable module-level exports serverUrl and latestPackage with
exported setter functions, and update test consumers to call those setters
instead of reassigning namespace-import properties. Preserve the existing mock
state and ensure updateMockUrl continues rebuilding URLs from the current server
URL.

Source: Path instructions

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.npmignore:
- Around line 37-41: Add /tsconfig.build.json to the root .npmignore alongside
/src/ so tsconfig.build.json is excluded from published packages. Verify with
npm pack --dry-run that tsconfig.build.json is absent while compiled lib/ files
remain included.

In `@src/acquisition-sdk/__tests__/acquisition-sdk.test.ts`:
- Around line 148-149: Update the acquisition SDK test setup so each test
receives a clean configuration: reset or recreate the module-level configuration
in beforeEach alongside mockApi, and remove the unused companionAppConfiguration
clone. In the test around the App Center serverUrl case, mutate the per-test
configuration rather than rebinding the shared object, ensuring ignoreAppVersion
and serverUrl changes cannot leak into later tests.

In `@src/acquisition-sdk/acquisition-sdk.ts`:
- Around line 96-100: Guard the optional callback before invoking it on the
_apiCallsDisabled paths in all three public methods, including
reportStatusDeploy and reportStatusDownload. Preserve the existing null
arguments and early returns, while matching the guarded callback behavior
already used by the response handlers.

---

Nitpick comments:
In `@src/acquisition-sdk/__tests__/acquisition-rest-mock.ts`:
- Around line 76-89: Remove the unused Server.onAcquire method from the
acquisition REST mock; no callers reference it, and its outdated
deploymentKey/isAvailable contract should not remain as misleading dead code.
- Around line 9-32: Replace the mutable module-level exports serverUrl and
latestPackage with exported setter functions, and update test consumers to call
those setters instead of reassigning namespace-import properties. Preserve the
existing mock state and ensure updateMockUrl continues rebuilding URLs from the
current server URL.

In `@src/acquisition-sdk/__tests__/acquisition-sdk.test.ts`:
- Line 266: Remove the duplicated assignment in the AcquisitionManager setup so
the acquisition variable is assigned to the new AcquisitionManager instance only
once.

In `@src/acquisition-sdk/acquisition-sdk.ts`:
- Line 216: Remove the arguments-based reassignment of callback in the
acquisition method, keeping the declared callback parameter unchanged. Preserve
the existing handling for all documented call shapes without introducing a false
value or relying on arguments.
- Around line 143-145: Update the !updateInfo branch in the acquisition request
callback to pass an explicit null error to callback, preserving the null
remotePackage argument and early return. Do not use the outer error parameter,
since this path represents no available update rather than a parsing failure.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: e52e6725-579b-441d-a9f3-8bdb2c40d80b

📥 Commits

Reviewing files that changed from the base of the PR and between d23b044 and de0b597.

⛔ Files ignored due to path filters (1)
  • package-lock.json is excluded by !**/package-lock.json
📒 Files selected for processing (13)
  • .gitignore
  • .npmignore
  • CLAUDE.md
  • CodePush.js
  • package.json
  • request-fetch-adapter.js
  • src/acquisition-sdk/__tests__/acquisition-rest-mock.ts
  • src/acquisition-sdk/__tests__/acquisition-sdk.test.ts
  • src/acquisition-sdk/acquisition-sdk.ts
  • src/acquisition-sdk/code-push-error.ts
  • src/acquisition-sdk/types.ts
  • tsconfig.build.json
  • tsconfig.json

Comment thread .npmignore
Comment thread src/acquisition-sdk/__tests__/acquisition-sdk.test.ts
Comment thread src/acquisition-sdk/acquisition-sdk.ts

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR vendors the CodePush acquisition-sdk (server-communication layer) into this repository and adds a dedicated TypeScript build pipeline (src/lib/) so the runtime can consume the SDK without depending on the archived code-push npm package and its transitive dependency chain.

Changes:

  • Vendored acquisition-sdk TypeScript sources into src/acquisition-sdk/ (types, errors, acquisition manager).
  • Added a separate TS build config (tsconfig.build.json) and npm scripts (build:ts, prepare) to generate publishable runtime output under lib/.
  • Updated runtime wiring to consume the vendored SDK (CodePush.js import change) and removed the X-CodePush-SDK-Version header.

Reviewed changes

Copilot reviewed 11 out of 14 changed files in this pull request and generated 4 comments.

Show a summary per file
File Description
tsconfig.json Excludes src/ from the integration-test TypeScript compile unit and documents the split.
tsconfig.build.json New TS config to compile vendored runtime TS (src/) to publishable JS/typings (lib/).
src/acquisition-sdk/types.ts Adds vendored request/response types for the acquisition client.
src/acquisition-sdk/code-push-error.ts Adds vendored error types used by the acquisition SDK.
src/acquisition-sdk/acquisition-sdk.ts Adds the vendored acquisition manager implementation and HTTP abstractions.
src/acquisition-sdk/__tests__/acquisition-sdk.test.ts Ports upstream unit tests (kept as reference; not wired into a runner).
src/acquisition-sdk/__tests__/acquisition-rest-mock.ts Ports upstream mock HTTP requester/server helpers for the tests.
request-fetch-adapter.js Drops X-CodePush-SDK-Version and updates the enum-sync reference.
package.json Adds build:ts and hooks it into setup/prepare; removes code-push dependency.
package-lock.json Removes code-push and its dependency chain from the lockfile.
CodePush.js Switches acquisition SDK import to the compiled vendored output under lib/.
CLAUDE.md Documents the new build:ts workflow and notes about unit test infra.
.npmignore Prevents publishing TypeScript source (/src/) and excludes local dev tooling docs.
.gitignore Ignores generated lib/ output (built during prepare).
Suppressed comments (1)

src/acquisition-sdk/acquisition-sdk.ts:242

  • When API calls are disabled, reportStatusDownload invokes callback unconditionally even though it is optional, which can throw if a caller omits it.
        if (AcquisitionManager._apiCallsDisabled) {
            console.log(`[CodePush] Api calls are disabled, skipping API call`);
            callback(/*error*/ null, /*not used*/ null);
            return;
        }

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread src/acquisition-sdk/acquisition-sdk.ts
Comment thread src/acquisition-sdk/acquisition-sdk.ts
Comment thread src/acquisition-sdk/acquisition-sdk.ts
Comment thread src/acquisition-sdk/__tests__/acquisition-sdk.test.ts
Adds src/acquisition-sdk/ (vendored TypeScript from the archived
microsoft/code-push repo, trimmed types.ts to only what's used, tests
ported for future reference but not wired into any runner), a
tsconfig.build.json + build:ts script compiling it to lib/ at
prepack/setup time, and points CodePush.js at the compiled output
instead of the code-push package. Drops the code-push dependency
entirely, which was only ever used for this one submodule and pulled
in the superagent/proxy-agent/vm2 CLI dependency chain that never
actually shipped in the bundled app JS.
@ofalvai
ofalvai force-pushed the push-optovlvxomwp branch from de0b597 to 98c82dd Compare July 31, 2026 09:35
@ofalvai
ofalvai merged commit b4f0900 into master Jul 31, 2026
4 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants