From 52d8eae385a4229b51139f19d3968b7a3ecaecb7 Mon Sep 17 00:00:00 2001 From: Claude Date: Sat, 18 Jul 2026 01:16:50 +0000 Subject: [PATCH] ci(publish-smoke): print the app's resolved pnpm + build-approval config before install (#3124) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The Publish Smoke gate died on ERR_PNPM_IGNORED_BUILDS with no way to see why: the failure was CI-only and every local repro (pnpm 10.31/10.33) honored the allowlist and exited 0. The missing fact: the scaffolded app declares no packageManager field (by design — it must test what a fresh user's pnpm resolves, not this repo's pin), so with corepack enabled the `pnpm` that installs the app is the LATEST pnpm (11.x), not the repo-pinned 10.31.0. pnpm 11 makes an unapproved build script a hard error where pnpm 10 only warned. The app's build approvals were declared for pnpm 11 in #3119; this adds the missing visibility so a future red run answers on its own which pnpm ran and whether it parsed the approvals. Prints, from inside the app dir right before install: `pnpm --version`, the build-approval keys pnpm actually resolved (onlyBuiltDependencies via either allowBuilds or onlyBuiltDependencies), and the pnpm-workspace.yaml as written. Diagnostics only — never fails the smoke. Co-Authored-By: Claude Opus 4.8 Claude-Session: https://claude.ai/code/session_01MN39HnZs8M92iDGqAMcvsK --- scripts/publish-smoke.sh | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/scripts/publish-smoke.sh b/scripts/publish-smoke.sh index 41b4fa6409..d3fa76389f 100644 --- a/scripts/publish-smoke.sh +++ b/scripts/publish-smoke.sh @@ -171,6 +171,26 @@ console.log( ); EOF + # Diagnostics for the ERR_PNPM_IGNORED_BUILDS failure class (#3124). The + # scaffolded app declares NO packageManager field (deliberately — see the + # header), so the `pnpm` that runs HERE is NOT this repo's pinned 10.31.0: + # with corepack enabled, corepack resolves the LATEST pnpm for a directory + # with no pin (11.x today). That divergence is the whole reason #3124's local + # repro (pnpm 10.31/10.33 both honor the allowlist) never reproduced the CI + # red — CI runs a stricter pnpm major. Print the resolved version, the + # build-approval config pnpm actually parsed, and the file it parsed it from, + # so any future red run answers "which pnpm, and did it see the approvals?" + # on its own. Never let a diagnostic fail the smoke (|| true). + log "pnpm environment inside the app (no packageManager pin — corepack resolves latest)" + ( cd "$APP_DIR" + echo " pnpm --version: $(pnpm --version 2>&1)" + echo " build-approval config pnpm resolved (onlyBuiltDependencies):" + pnpm config list 2>/dev/null | grep -iE 'only-built|built-dependencies|strict-dep-builds' | sed 's/^/ /' \ + || echo " (no build-related config keys reported)" + echo " pnpm-workspace.yaml as written:" + sed 's/^/ /' pnpm-workspace.yaml + ) || true + log "Installing (pnpm, tarball-pinned)" (cd "$APP_DIR" && pnpm install --no-frozen-lockfile)