From be0397538df5c148414cea749a6ceba100c4e8fa Mon Sep 17 00:00:00 2001 From: Altay Date: Thu, 20 Aug 2026 06:59:15 +0300 Subject: [PATCH] fix(ci): keep lockfile maintenance from bumping manifest ranges pnpm 11 update --lockfile-only also rewrites package.json ranges and the lockfile's specifier records; committing only the lockfile shipped a specifier mismatch that fails frozen installs (taizn#64, run 32329772704). --no-save keeps the manifest and specifier records intact while still refreshing direct and transitive resolutions in range, proven on taizn manifests (ws 8.21.3, @types/node 26.2.0, postcss 8.5.26 with specifiers unchanged; frozen install passes). Also assert the refresh touches nothing but pnpm-lock.yaml. Refs putdotio/putio-frontend#29 Co-Authored-By: Claude Fable 5 --- .github/workflows/lockfile-maintenance.yml | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/.github/workflows/lockfile-maintenance.yml b/.github/workflows/lockfile-maintenance.yml index 05b4c4d..d758830 100644 --- a/.github/workflows/lockfile-maintenance.yml +++ b/.github/workflows/lockfile-maintenance.yml @@ -62,8 +62,20 @@ jobs: with: node-version-file: .node-version + # --no-save keeps package.json and the lockfile's specifier records at + # their committed values; without it pnpm 11 update rewrites both and a + # lockfile-only commit fails frozen installs with a specifier mismatch. - name: Refresh transitive lockfile resolutions - run: corepack pnpm update --lockfile-only -r + run: corepack pnpm update --no-save --lockfile-only -r + + - name: Assert only the lockfile changed + run: | + set -euo pipefail + if ! git diff --quiet -- ':(exclude)pnpm-lock.yaml'; then + echo "unexpected working-tree changes beyond pnpm-lock.yaml:" >&2 + git status --porcelain >&2 + exit 1 + fi - name: Open or update pull request env: