build(pnpm): migrate settings to pnpm-workspace.yaml for pnpm 11 #54
No reviewers
Labels
No labels
dependencies
major
security-pin
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set
Reference
trails-cool/trails!54
Loading…
Reference in a new issue
No description provided.
Delete branch "ci/pnpm-11-migrate-settings"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Replaces #49, which cannot work as written.
Renovate bumps only
packageManager. pnpm 11 stops reading thepnpmfield frompackage.json, so that bump alone would silently drop 13 dependency overrides and the build-script allowlist. This does the migration that has to accompany it.overrides— straight moveMoves to
pnpm-workspace.yamlunchanged. These are CVE remediation pins (the value is the minimum patched version inside the range its consumers expect, not the newest release), and that reasoning now sits next to them.onlyBuiltDependencies— NOT a movepnpm 11 removed it, along with
onlyBuiltDependenciesFile,neverBuiltDependencies,ignoredBuiltDependenciesandignoreDepScripts, replacing all of them withallowBuilds— which takes a map, not an array:Relocating the old key verbatim would have been accepted as unknown YAML and ignored, so
@sentry/cliwould ship without its binary and esbuild without its platform binary. That fails at build time with nothing pointing at the cause — which is why this was checked against pnpm docs rather than assumed.Verified locally
LOCKFILE_MAJOR_VERSION = "9"in the pnpm 11.18.0 bundle matches this repo'slockfileVersion: '9.0', so--frozen-lockfileshould not fail on a format bump.pnpm-lock.yamlis therefore untouched.NOT verified locally — CI is the verifier
typecheck/lint/test/build under pnpm 11. The install could not finish: the registry was serving tarballs at ~6 KiB/s and the run died on
TimeoutErrorafter exhausting retries. If--frozen-lockfiledoes reject the lock, the fix is regenerating it on a healthy network, not reverting this.Trap worth knowing
pnpm 11's first install wants to purge
node_modulesand aborts without a TTY (ERR_PNPM_ABORTED_REMOVE_MODULES_DIR_NO_TTY). CI setsCI=truewhich auto-confirms, so CI is unaffected — but locally you needCI=trueorconfirmModulesPurge=false.Close #49 in favour of this once green.
CI caught what the local install could not: pnpm 11 fails the install outright when a dependency has an install script that is neither allowed nor explicitly denied. [ERR_PNPM_IGNORED_BUILDS] Ignored build scripts: @fission-ai/openspec@1.6.0, canvas@3.2.3, unrs-resolver@1.12.2 Under pnpm 10's `onlyBuiltDependencies` the list was an allowlist and everything absent from it was skipped in silence. `allowBuilds` in pnpm 11 wants a decision recorded for each such package, and treats an unrecorded one as an error rather than a warning — so listing only the two we do build was incomplete. These three are set to `false`, which preserves exactly the behaviour they already had: none of them has ever run its install script here, and canvas would need a native toolchain that CI does not have. Nothing changes about what gets built; the change is that the decision is now written down. A newly added dependency with an install script will fail CI until it appears here, which is the useful half of pnpm's stricter stance. Worth recording why the local run missed it: the install never got far enough to reach the build phase — the registry was serving tarballs at ~6 KiB/s and it died on TimeoutError. The same run did get past `--frozen-lockfile` validation without ERR_PNPM_OUTDATED_LOCKFILE, which rules out the lockfile as a cause and matches LOCKFILE_MAJOR_VERSION = "9" in the pnpm 11.18.0 bundle. Refs #49 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01X8hNxgYp777FRqYtVmQNaU38cb2d263b3229639ba649ce9b8074805a63443d