Manual Recurring Maintenance Tasks

[rajsite]

🧹 Tech Debt

There are certain tasks that are difficult to automatically handle in source and cause regressions that may not be spotted.
This issue tracks those tasks, gives instructions for auditing them, and captures the last time they were audited.

---

Validate lifecycle overrides call super

Procedure

• Verify that all overrides for connectedCallback and disconnectedCallback invoke super (easy to do by scanning two VSCode search results)
  

Why is it not automated?

• Not enforceable via TypeScript yet: keyword to force calling the super on any method microsoft/TypeScript#21388

Last checked

• 2024-09-05

---

Validate default label provider strings are aligned

Procedure

• Check the nimble component label provider default translation strings (nimble-components/src/label-provider/**/label-token-defaults.ts) align with
  • Angular label provider directive default localization strings (nimble-angular/label-provider/**/ directives and tests)
  • Blazor wrappers and tests

Why not automated?

• I think the localize tag helper used in the directives didn't make it easy to compose the strings from the constants exported from nimble components. Solutions were trying to do source code generation which seemed unnecessarily complex. They are just defaults, all meant to be overridden in specific app localizations anyway.

Last checked

• 2024-09-05

---

Validate karma tests running on Safari

Procedure

• Check that the nimble component tests running on Safari are passing.

Why not automated?

• We run tests in WebKit as a proxy for Safari. The ROI of setting up a separate build agent just to run Safari on MacOS is low.

Last checked

• 2024-09-05

---

Keep pinned dependencies up-to-date

Procedure

• Update the pinned version of playwright and apache-arrow in all package.json files and Microsoft.Playwright and Apache.Arrow in csproj files.
  • When updating in csproj files make sure to use the nuget-specific exact semver range format.
• Make sure to bump the package version number to a version that exists on both:
  • nuget: https://www.nuget.org/packages/Microsoft.Playwright for playwright and https://www.nuget.org/packages/Apache.Arrow for arrow
  • npm: https://www.npmjs.com/package/playwright for playwright and https://www.npmjs.com/package/apache-arrow for arrow
• Make sure to use a pinned package version (as we only run the postinstall in the root package to avoid the scenario that we install multiple copies of all the browsers for the monorepo. Not necessarily a deal breaker but not ideal)
• Note: It's expected that the next playwright update should resolve Disabled Webkit wafer map tests due to OffscreenCanvas #2169. See if that is the case, re-enable the tests, and remove this note.

Why not automated?

• Because for some reason the playwright version on nuget does not always align with the npm package. So if we let rennovate bump the playwright versions may not align across packages.
• Because we want the JS and Nuget version of playwright to update at the same time (rennovate likely could be configured to do this)

Last checked

• 2024-06-05

---

Review and update status of Blocked issues

Procedure

• Review list of blocked issues, and if there has been a change, add a comment with the newest status and remove the Blocked label if appropriate.

Why not automated?

• Each issue requires a manual review process.

Last checked

• 2024-06-05

---

Review disabled tests

Procedure

• Search for all disabled tests (xit, xdescribe) and ensure they have comments linking to issues.
• If a test has been disabled for more than a few weeks, try to get it some attention.

Why not automated?

• Each test requires a manual review process.

Last checked

• Never

---

Audit dependency vulnerabilities

Procedure

• Locally run npm audit or inspect the npm ci step of a recent pipeline build to see what vulnerabilities are reported
• If there are vulnerabilities with fixes available, try to fix them using one of these approaches. Use your (or code owner) judgement to pick between them based on how well they eliminate vulnerabilities and what other issues they introduce.
  • In a local branch, delete node_modules and package-lock.json, run npm install, and submit the regenerated package-lock.json
  • Run npm audit fix and submit the regenerated package-lock.json.

Why not automated?

• When we added npm audit to pipelines we found it annoying that pipelines immediately broke when new vulnerabilities were discovered. Alternatives like using security tooling haven't been prioritized.

Last checked

• 2024-09-05

[jattasNI]

Manual tasks complete for this quarter 🎉

[jattasNI]

I added a step to manually run npm audit as described in #2240.