Skip to content

Commit dcc238a

Browse files
authored
Fix CodeQL issues for checked-in yarn binaries (#1017)
## Description This PR removes unnecessary `.yarn` folders from the repo and prevents them from being checked-in / scanned by CodeQL in the future. ### Why Having yarn binaries checked-in is a security risk and CodeQL complains about issues in the scripts (which we can't fix, or even see, as they're obfuscated as binary files). Removing the `.yarn` folder for older samples is not a problem, but newer samples which use Yarn 3, such as `NativeModuleSample/cpp-lib`, need the Yarn 3 binaries checked-in. Unfortunately there's no way to get around this. Yarn refuses to acknowledge this anti-pattern and security issue (see yarnpkg/yarn#7741) and the "solution" to require users to install Yarn 3 via `corepack` does not work in GitHub CI (see actions/setup-node#480). I've tried every workaround combination in these two issues and none work. Closes #1016 ## Screenshots N/A ###### Microsoft Reviewers: [Open in CodeFlow](https://microsoft.github.io/open-pr/?codeflow=https://github.com/microsoft/react-native-windows-samples/pull/1017)
1 parent 8cf1146 commit dcc238a

File tree

4 files changed

+4
-148055
lines changed

4 files changed

+4
-148055
lines changed

.gitignore

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,4 +14,5 @@ website/i18n/*
1414

1515
# This is not a mono repo, ignore files from people accidentally running yarn in the wrong places
1616
/yarn.lock
17-
/samples/yarn.lock
17+
/samples/yarn.lock
18+
/samples-old/yarn.lock

CodeQL.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,3 +5,5 @@ path_classifiers:
55
docs:
66
- "**/docs"
77
- "**/website/versioned_docs"
8+
library:
9+
- "**/.yarn"

0 commit comments

Comments
 (0)