Repository navigation
ci(lockfile): check pnpm-lock.yaml on pull requests and pushes to main - #1
Merged
Merged
Conversation
deploy.yml installs with `--frozen-lockfile`, so a package.json change that reached main without its lockfile update only failed once a release was tagged: v1.87.2 failed on the oxlint-tsgolint floor raised in npm/oxlint/package.json and was re-cut as v1.87.3. The same check now runs on every pull request and push to main, with `--lockfile-only` so it compares the lockfile with the workspace manifests without downloading packages. A release commit is replayed onto an upstream tag rather than taken from main, so the README also runs the check on the release commit before the tag is pushed. Co-Authored-By: LLM <noreply@block65.dev>
maxholman
approved these changes
Oct 17, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Release v1.87.2 failed on an outdated pnpm lockfile and had to be re-cut as v1.87.3. Every pull request and push to
mainnow runspnpm install --frozen-lockfile --lockfile-only, the check the Release workflow makes at install time, so apackage.jsonchange without its lockfile update fails before anything is tagged. It takes seconds and downloads no packages. The release steps in the README run the same check on the release commit before the tag is pushed, since that commit is replayed onto an upstream tag rather than taken frommain.Verified by hand:
pnpm install --frozen-lockfile --lockfile-only(pnpm 12.7.0) passes on this branch, and fails withERR_PNPM_OUTDATED_LOCKFILE(oxlint-tsgolint>=7.0.2003vs>=7.0.200303) on both the v1.87.2 tag and cfc4a93, themaincommit it came from; actionlint 1.7.7 reports no issues in either workflow.