Repository navigation
fix(deps): lockfile violates minimumReleaseAge policy; add CI check - #244
Merged
Merged
Conversation
The Deploy Docs workflow failed its supply-chain check because the lockfile contained rolldown@1.2.16 and its platform bindings, published five days earlier — inside the repo's 7-day minimumReleaseAge window. The local lockfile regeneration that introduced it ran with a PNPM_CONFIG_MINIMUM_RELEASE_AGE environment override, which masked the workspace policy, so the violation was never seen before pushing. - Regenerate pnpm-lock.yaml with the real policy active; resolution naturally converges on rolldown@1.2.15 (published 2026-10-21) - Pin pnpm@12.15.0 via the packageManager field so local installs, the docs workflow, and CI all resolve with the same pnpm version instead of whatever pnpm@latest ships - Add an npm job to the Build workflow that runs the same frozen-lockfile install on pull requests, so a lockfile violating the policy fails the PR check instead of the post-merge docs deployment - Scope the Build workflow's paths triggers to npm manifests and the lockfile so the new job runs when it can catch this
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes the
Deploy Docsfailure onmainand adds CI coverage so this class of failure is caught before merge.Root cause
pnpm-lock.yamlcontainedrolldown@1.2.16(plus its 15 platform bindings), published 2026-10-29 — inside the repo's 7-dayminimumReleaseAge: 10080window. CI'spnpm install(viawithastro/action) re-verifies every lockfile entry against the policy on a fresh runner and failed withERR_PNPM_MINIMUM_RELEASE_AGE_VIOLATION.How it slipped through: the local lockfile regeneration ran with a
PNPM_CONFIG_MINIMUM_RELEASE_AGEenvironment override active, which silently replaced the workspace's 7-day policy with 1 day — so the too-new entry passed locally. And no CI job runspnpm installon pull requests (the Build workflow only doesdotnet restore/build/test), so the first place the lockfile was ever verified was the post-merge docs deployment onmain.Fix
pnpm-lock.yamlwith the real policy active (env override unset). Resolution naturally converges onrolldown@1.2.15(published 2026-10-21) and also dedupes the stale1.2.13entries from astro. No overrides needed.packageManager: pnpm@12.15.0inpackage.jsonandpnpm@12.15.0in the docs workflow, so local installs and CI resolve with the same pnpm instead of whateverpnpm@latestships that day.npmjob in the Build workflow that runspnpm install --frozen-lockfilefromdocs/(exactly what the deploy does) on every pull request. A lockfile entry younger than the policy now fails the PR check before merge.Verification
PNPM_CONFIG_MINIMUM_RELEASE_AGEunset: original lockfile fails with the identical error, fixed lockfile passes the supply-chain verification.pnpm install --frozen-lockfile,pnpm docs:build(10 pages),dotnet build— all clean.actionlinton both modified workflows: OK.Once this merges, the
Deploy Docsrun onmainshould go green again.