chore: solana wallet snap integrate packages - #72
Conversation
Place the snap under packages/ so Yarn workspaces can resolve it, and update yarn.lock for the new workspace dependencies.
Match description, keywords, and test scripts to the monorepo workspace constraints used by the other snaps.
Bump concurrently, dotenv, @metamask/superstruct, and bignumber.js to match bitcoin-/tron-wallet-snap and clear yarn constraints mismatches. Refresh snap.manifest.json after rebuild (shasum, repository, platformVersion).
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
|
All alerts resolved. Learn more about Socket for GitHub. This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored. Ignoring alerts on:
|
Battambang
changed the title
Sync with Release/3.0.0 (#71) before continuing Phase C work.
Match bitcoin-/tron-wallet-snap exact ranges (11.1.1 and 2.0.0) so yarn constraints version consistency passes for these deps.
Bump root @types/lodash to ^4.17.15 so yarn constraints version consistency matches the Solana workspace declaration.
Align rimraf to ^6.0.1 across workspaces that declare it so yarn constraints version consistency passes and installs a single v6.
Narrow @metamask/snaps-cli to ^8.3.0 so yarn constraints version consistency matches bitcoin-/tron-/sample-snap (still resolves to 8.4.1).
Sync with bitcoin keyring v2 (#43) and regenerate yarn.lock after resolving the lockfile conflict.
Bump snaps-cli, snaps-sdk, superstruct, keyring-api, and keyring-snap-sdk declarations to match bitcoin-/tron-wallet-snap after #43 (installed versions unchanged).
Align @metamask/key-tree to ^10.1.1 with bitcoin-/tron-wallet-snap so yarn constraints pass.
Absorb existing Solana snap lint findings into eslint-suppressions.json, and apply minor autofixes from eslint --fix.
Assign @MetaMask/networks as owners for packages/solana-wallet-snap, matching bitcoin- and tron-wallet-snap.
Update the generated packages section so readme-content:check passes with the new workspace.
Collapse ignore, minipass, and package-json-from-dist to their highest resolved versions so yarn dedupe --check passes in CI.
Satisfy the Check changelog CI requirement that Unreleased entries reference the current pull request.
|
@SocketSecurity ignore npm/@types/express-serve-static-core@5.1.2 package used in |
|
@SocketSecurity ignore npm/glob@13.0.6 package used in |
|
@SocketSecurity ignore npm/@solana/rpc-transport-http@2.1.0 socket.dev security reporting has all security metrics very high score confidence (all metrics green >96) |
|
@SocketSecurity ignore npm/@solana-program/compute-budget@0.7.0 socket.dev is showing the solana-devs author group with several package score confidence. |
|
@SocketSecurity ignore npm/@solana/rpc-transport-http@2.3.0 socket.dev security reporting has all security metrics very high score confidence (all metrics green >96) |
|
@SocketSecurity ignore npm/@solana-program/system@0.7.0 socket.dev is showing the solana-devs author group with several package score confidence. |
Treat Infura-keyed mainnet/devnet RPC and websocket URLs as secrets; keep public testnet, localnet, and explorer URLs as repository vars.
Update solana and bitcoin shasums so yarn build leaves a clean tree in CI (bitcoin drifts due to shared yarn.lock changes).
Avoid parallel workers colliding on the mock RPC port 8899 in CI, matching the source snap-solana-wallet test script.
Keep the monorepo-required test script string, and run Solana tests serially in jest.config to avoid mock RPC port 8899 collisions.
c968237 to
fecb49a
Compare
Match bitcoin-/tron-/sample-snap after #75: split LICENSE.MIT / LICENSE.APACHE2 and set package.json license to (MIT OR Apache-2.0).
Override production for Solana test matrix builds so snaps-jest gets dev permissions, matching the source snap CI. Restore the production snap.manifest shasum before the dirty-tree check.
Link the Unreleased entry to #72 so Check changelog passes for the collateral bitcoin-wallet-snap change.
| env: | ||
| ENVIRONMENT: ${{ matrix.package-name == '@metamask/solana-wallet-snap' && 'test' || 'production' }} | ||
| - run: yarn workspace ${{ matrix.package-name }} run test | ||
| env: | ||
| ENVIRONMENT: ${{ matrix.package-name == '@metamask/solana-wallet-snap' && 'test' || 'production' }} | ||
| - name: Restore solana snap.manifest after test build | ||
| if: matrix.package-name == '@metamask/solana-wallet-snap' | ||
| run: git checkout -- packages/solana-wallet-snap/snap.manifest.json |
There was a problem hiding this comment.
The Test job overrides ENVIRONMENT only for @metamask/solana-wallet-snap:
- Build + test steps: test for Solana, production for other snaps
- Then restore packages/solana-wallet-snap/snap.manifest.json so the dirty-tree check still passes (test builds change the shasum; the dedicated Build job still validates the production shasum)
Why Solana needs this (Bitcoin/Tron do not in this CI path)
Solana feature tests (snaps-jest / installSnap) call the snap as a localhost dapp (http://localhost:3000) and exercise send/confirmation RPCs. Solana’s permissions.ts allowlists that origin and those methods only when the baked-in environment is local or test. With production, dapp permissions are empty → CI fails with Permission denied (4100).
ENVIRONMENT is injected at snap build time, so the Test job must rebuild Solana with ENVIRONMENT=test. Matching the source snap-solana-wallet CI Test job.
Bitcoin: no ENVIRONMENT-gated origin allowlist.
Tron: has a similar gate, but its suites in this workflow mostly don’t depend on localhost dapp permissions the way Solana’s feature UI tests do (often unit tests or metamask origin, which stays allowed in production).
1 participant
This pull request integrates the Solana Wallet Snap into the monorepo, updates related configuration and documentation, and aligns dependencies and workflows to support the new package. It also includes license files for the Solana package and minor dependency updates for other packages.
Solana Wallet Snap Integration and Licensing:
@metamask/solana-wallet-snappackage to the monorepo, including its README and changelog, and updated the package list inREADME.md.LICENSE,LICENSE.APACHE2, and referencingLICENSE.MIT.Monorepo and Ownership Updates:
packages/solana-wallet-snapto.github/CODEOWNERSfor ownership tracking.CI/CD Workflow Enhancements:
lint-build-test.yml,main.yml,publish-release.yml,publish-preview.yml) to inject new Solana-related environment variables, handle Solana-specific test builds, and restore the Solana snap manifest after test builds.Dependency and Manifest Updates:
rimrafand@types/lodashdependencies in root and sample package manifests for improved compatibility and security.snap.manifest.jsonshasum for the Bitcoin Wallet Snap after aligning Solana dependencies.Changelog and Documentation: