RFC: locked build environments for git-hosted dependencies

[zkochan]

Summary

When pnpm builds a git-hosted dependency, the package manager that runs the build (Yarn, npm, Bun, or pnpm) is resolved live from the registry — often from a floating spec sniffed from the dependency's lockfile — and the build always runs on the host's Node.js. This RFC proposes to:

1. Record the resolved build environment in the consuming project's lockfile — exact package-manager version plus tarball integrity (and the provisioned runtime version) on the git dependency's snapshot — and make that record authoritative on subsequent installs.
2. Provision the Node.js runtime a dependency pins via devEngines.runtime, symmetric with how the package manager is already provisioned from devEngines.packageManager / packageManager.

Motivation in two sentences: floating package-manager specs make git-dependency builds nondeterministic across machines and time (undetectably, since git resolutions carry no integrity), and --frozen-lockfile currently downloads and executes an unlocked executable resolved live from the registry — a hole in both reproducibility and the supply-chain guarantee the lockfile is supposed to provide.

Opened as a draft for discussion; the Unresolved Questions section lists the open naming/shape/scope decisions.

---

Written by an agent (Claude Code, claude-fable-5).

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 783a44c9-21d0-4009-bac1-9dfde224ebff

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}