Repository navigation
fix(ci): point Dependabot npm ecosystem at pnpm workspace root - #235
Merged
Merged
Conversation
The npm ecosystem had two entries: directory: "/" (the pnpm workspace root) and directory: "/docs/". Both resolve the same shared pnpm-lock.yaml at the repo root, because Dependabot's npm ecosystem handles a pnpm workspace lockfile at the root and does not split a single shared lockfile per subdirectory. That split the docs dependency updates across two independent PR streams: - /docs entry produced manifest-only PRs (e.g. #229: docs/package.json only, no lockfile change) - / entry produced lockfile-only PRs for docs' transitive deps (e.g. #232 zod, #233 undici, #234 postcss-selector-parser: pnpm-lock.yaml only, no manifest change) Since those PRs merge in arbitrary order, pnpm-lock.yaml accumulated drift: an orphaned shiki@4.4.3 + @shikijs/*@4.4.3 tree, a stale @astrojs/markdown-satteri@0.4.3 variant, and a missing @astrojs/mdx@8.0.1(...markdown-satteri@0.4.4...) snapshot. pnpm install --frozen-lockfile still passed only because nothing reachable references the orphans. Fixes: - Drop the /docs/ npm entry (and its redundant astro group and chore(deps-docs) prefix). Dependabot now updates workspace manifests and the shared pnpm-lock.yaml in the same PR. - Regenerate pnpm-lock.yaml to remove the accumulated drift. Verification: pnpm install --frozen-lockfile passes, a follow-up pnpm install --lockfile-only reports 'Already up to date', and the docs site builds successfully (pnpm exec astro build).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Same root cause as identified in nikcio/Nikcio.UHeadless#637: this repo has two
npmentries in.github/dependabot.yml— one atdirectory: "/"(the pnpm workspace root) and one atdirectory: "/docs/". Both resolve the same sharedpnpm-lock.yamlat the repo root; Dependabot's npm ecosystem does not split a pnpm workspace lockfile per subdirectory.That split docs dependency updates across two independent PR streams:
/docsgroup)docs/package.jsononlypnpm-lock.yamlonlypnpm-lock.yamlonlypnpm-lock.yamlonly/docsbumps)docs/package.jsononly, closed as supersededBecause the two streams merge in arbitrary order,
pnpm-lock.yamlaccumulated real drift.pnpm install --lockfile-only --fix-lockfileonmainproduces a 121-line correction:shiki@4.4.3+@shikijs/*@4.4.3dependency tree (13 entries, referenced by nothing) left behind by chore(deps): Bump shiki from 4.4.3 to 4.5.0 #222/chore(deps): Bump astro from 7.3.8 to 7.4.1 #230@astrojs/markdown-satteri@0.4.3variant alongside the current 0.4.4, with an orphaned@astrojs/prism@4.0.2and@astrojs/internal-helpers@0.12.0@astrojs/mdx@8.0.1(@astrojs/markdown-satteri@0.4.4)(astro@7.4.1...)snapshotpnpm install --frozen-lockfilestill passes onmainonly because nothing reachable references the orphaned entries — the lockfile is not in the state pnpm would generate, it just happens to be a superset.Fix
/docs/npm entry (plus its now-redundantastrogroup andchore(deps-docs)prefix). Dependabot now updates the workspace manifests (/,/docs) and the sharedpnpm-lock.yamlin the same PR, and groups related transitive bumps instead of splitting them.pnpm-lock.yamlto remove the accumulated drift.The existing
biomegroup, cooldowns, schedule, andchore(deps)prefix are unchanged. NuGet and github-actions entries are untouched.Verification
pnpm install --frozen-lockfilepasses on this branch.pnpm install --lockfile-onlyreports "Already up to date" — the lockfile is now in the exact state pnpm generates.pnpm exec astro buildin/docscompletes (10 pages, search index, sitemap).