Azure-pipelines-tasks: [Gulp Task]: Global gulp version being used instead of my packages.json version

[scott-lin]

Issue Description

The global version of gulp installed on the agent is being used instead of the version installed via my packages.json. Before the gulp task is run, an npm install task is run successfully targeting the packages.json below. I've confirmed the packages.json version of gulp is installed during the npm step by turning on verbose logging.

My gulpfile.js and packages.json files are at the root of my repo.

Package.json

    "devDependencies": {
        "@types/chai": "^4.0.5",
        "@types/mocha": "^2.2.44",
        "@types/node": "^10.5.2",
        "chai": "^4.1.2",
        "del": "^3.0.0",
        "gulp": "^4.0.0",
        "gulp-delete-lines": "0.0.7",
        "gulp-flatten": "^0.4.0",
        "gulp-install": "^1.1.0",
        "gulp-mocha": "^6.0.0",
        "gulp-nuget": "^1.2.0",
        "gulp-run": "^1.7.1",
        "gulp-string-replace": "^1.1.1",
        "gulp-typescript": "^3.2.3",
        "mocha": "^4.0.1",
        "mocha-junit-reporter": "^1.17.0",
        "mochawesome": "^2.3.1",
        "request": "^2.87.0",
        "tfx-cli": "^0.5.14",
        "ts-node": "^7.0.0",
        "typescript": "^2.9.2"
    }

Task Inputs

Gulp task

• File path: gulpfile.js
• Advanced
  
  
  
  • gulp.js location: node_modules/gulp/bin/gulp.js
  
  

Error logs

2018-07-25T21:53:14.6303055Z ##[section]Starting: gulp
2018-07-25T21:53:14.6308242Z ==============================================================================
2018-07-25T21:53:14.6308366Z Task         : Gulp
2018-07-25T21:53:14.6308456Z Description  : Node.js streaming task based build system
2018-07-25T21:53:14.6308561Z Version      : 0.130.0
2018-07-25T21:53:14.6308644Z Author       : Microsoft Corporation
2018-07-25T21:53:14.6308741Z Help         : [More Information](https://go.microsoft.com/fwlink/?LinkID=613721)
2018-07-25T21:53:14.6308861Z ==============================================================================
2018-07-25T21:53:14.9819487Z [command]C:\Users\svccbld\AppData\Roaming\npm\gulp.cmd --gulpfile E:\agent_work\62\s\gulpfile.js
2018-07-25T21:53:17.5552020Z [21:53:17] Using gulpfile E:\agent_work\62\s\gulpfile.js
2018-07-25T21:53:17.5565027Z C:\Users\svccbld\AppData\Roaming\npm\node_modules\gulp\bin\gulp.js:129
2018-07-25T21:53:17.5565300Z     gulpInst.start.apply(gulpInst, toRun);
2018-07-25T21:53:17.5565577Z                    ^
2018-07-25T21:53:17.5565686Z 
2018-07-25T21:53:17.5565858Z TypeError: Cannot read property 'apply' of undefined
2018-07-25T21:53:17.5566100Z     at C:\Users\svccbld\AppData\Roaming\npm\node_modules\gulp\bin\gulp.js:129:20
2018-07-25T21:53:17.5566424Z     at _combinedTickCallback (internal/process/next_tick.js:131:7)
2018-07-25T21:53:17.5566632Z     at process._tickCallback (internal/process/next_tick.js:180:9)
2018-07-25T21:53:17.5566957Z     at Function.Module.runMain (module.js:695:11)
2018-07-25T21:53:17.5567126Z     at startup (bootstrap_node.js:191:16)
2018-07-25T21:53:17.5567279Z     at bootstrap_node.js:612:3
2018-07-25T21:53:17.5921096Z ##[error]Gulp failed with error: C:\Users\svccbld\AppData\Roaming\npm\gulp.cmd failed with return code: 1
2018-07-25T21:53:17.5933925Z ##[section]Finishing: gulp

[scott-lin]

@daveVSTS, can you provide an ETA on this issue? We're currently blocked from getting our CI to work.

[knom]

I'm running into exactly the same issue!
Folks should switch to GULP 4 - because of serious vulnerabilities in GULP 3 dependencies..
(which you can't as this issue is blocking it..)

Any ETA on this?

[scott-lin]

@azureDaveOps / @bryanmacfarlane, please update us on this issue's ETA, or provide a workaround / Gulp alternative recommendation if fixing is not a priority.

We're being flagged for using Gulp 3.x because of its security vulnerabilities, but have no supported upgrade path in Azure DevOps since Gulp 4 isn't supported.

[moswald]

If you go to your definition's gulp task and expand the Advanced section, there is an edit box for setting the gulp.js location.

[scott-lin]

@moswald, not to be rude, but did you read my initial post that says I set this advanced input? Did I set it up wrong?

[moswald]

Oh! Very sorry, I did _not_ see that. I will reopen this.

The value you set is node_modules/gulp/bin/gulp.js, which is also the default. I wonder if that could be confusing things. Could you try placing that in a different folder or with a different name?

[scott-lin]

@moswald, unfortunately, I don't have control over where Gulp is installed -- NPM installs it in an upstream build pipeline task via my repositories package.json. Let me know if I'm missing something.

[moswald]

No problem. I was just hoping that it would be a quick thing to test. I'll investigate why this textbox isn't overriding your gulp location.

[moswald]

@scott-lin My PR 8851 will fix the issue. It will go out with the next version of Azure DevOps. I think we will begin deploying it the week after Thanksgiving. You will have to update your definition to point to the new (preview) version of the Gulp Task.

[scott-lin]

It will go out with the next version of Azure DevOps. I think we will begin deploying it the week after Thanksgiving.

@moswald, is the deployment still on for this week? Just trying to get a more accurate ETA. Thanks.

[moswald]

Yes, we've already deployed to the first ring of accounts. I'll follow up with you offline to find out when exactly you can expect to see it.