Publish Smoke has never passed on main — app install dies on ERR_PNPM_IGNORED_BUILDS despite the allowlist

[os-zhuang]

The Publish Smoke gate added by #3100 has failed on every main run since it landed — the first failure is its own landing commit (89467f50b, 15:39 +08:00), 9 minutes later. It has never been green on main ({"failure": 9, "cancelled": 1, "success": 1} — the one success predates the main runs).

This is not a regression from any later commit; every subsequent main commit simply inherits the red. Filing rather than fixing since it is #3100's own stabilization and nobody has an in-flight branch for it.

Failure

The gate reaches the smoke app's install and dies there:

== Pinning @objectstack/* to local tarballs via project-local overrides
  wrote /tmp/objectstack-publish-smoke.sV84SA/smoke-app/pnpm-workspace.yaml (67 overrides)
== Installing (pnpm, tarball-pinned)
...
+ @objectstack/cli 15.2.0
+ typescript 6.0.3 (7.0.2 is available)
[ERR_PNPM_IGNORED_BUILDS] Ignored build scripts: better-sqlite3@12.11.1, esbuild@0.28.1
Run "pnpm approve-builds" to pick which dependencies should be allowed to run scripts.
##[error]Process completed with exit code 1.

Run: https://github.com/objectstack-ai/framework/actions/runs/29576978349

This is puzzling on two counts:

1. scripts/publish-smoke.sh:129-131 does write onlyBuiltDependencies: [better-sqlite3, esbuild] into the app's pnpm-workspace.yaml (and the log confirms the file was written) — so those two builds should be allowed, not ignored.
2. ERR_PNPM_IGNORED_BUILDS is an error, not the usual warning — implying strict dep-builds is on somewhere.

Hypotheses ruled out (local repro, same allowlist + a standalone pnpm-workspace.yaml)

Hypothesis	Result
pnpm version drift (CI runs 10.31.0)	❌ ruled out — pnpm@10.31.0 honors the allowlist locally, exit 0. (The 10.28.1→10.31.0 bump is also from March, unrelated to today.)
Newer pnpm being stricter	❌ ruled out — 10.33.0 behaves the same
CI=true making ignored builds fatal	❌ ruled out — with CI=true and the allowlist removed entirely, pnpm 10.31.0 still only warns (exit 0)
Repo-level strictDepBuilds leaking in	❌ not present in pnpm-workspace.yaml, .npmrc, package.json, or the workflow

So the strictness is CI-environment-specific and does not reproduce locally. Remaining leads for whoever picks this up:

• The smoke app (/tmp/objectstack-publish-smoke.*/smoke-app) has no packageManager field, while the repo pins pnpm@10.31.0. With corepack enable (publish-smoke.yml:126), the pnpm that runs inside the /tmp app may resolve differently from the repo's pinned one — worth printing pnpm --version from inside $APP_DIR as the first diagnostic.
• A runner-level ~/.npmrc / NPM_CONFIG_* / PNPM_* setting.

Cheap instrumentation to land first: cd "$APP_DIR" && pnpm --version && pnpm config list before the install, and cat pnpm-workspace.yaml, so the next red run answers this directly.

Note the gate's value is high (it exists to prevent a repeat of the #3091 P0), which is exactly why a permanently-red gate is worse than none — it trains everyone to ignore it.

🤖 Generated with Claude Code