fix(ci): install committed dependencies before preview migrations

.claude/skills/test-pkg-pr-new-migrate/SKILL.md

@@ -17,7 +17,7 @@ Required inputs: a `<PR-or-SHA>` (the build to verify) and a `<project-path>`. I
 ```
 
 - First arg is a PR number or commit SHA; the script resolves the immutable commit via the bridge `x-commit-key` header and verifies the bridge serves it (the preview publish workflow, triggered by the `preview-build` label, registers each commit).
-- Never touches `~/.vite-plus`; clears only the workspace ROOT lockfile + `node_modules` before migrating; refuses a dirty worktree unless `ALLOW_DIRTY=1`; prints the project's `git status`/`diff` at the end — inspect that to confirm the migration result.
+- Never touches `~/.vite-plus`; installs the project's committed dependencies before migrating, because `vp migrate` reads the original Vitest version from the lockfile or `node_modules`; refuses a dirty worktree unless `ALLOW_DIRTY=1`; prints the project's `git status`/`diff` at the end — inspect that to confirm the migration result.
 
 **The build under test must include the "migrate writes the bridge registry" feature** (this session's work / current branch head onward). The harness no longer writes the registry itself — it relies on `vp migrate` doing it. Testing an older build with this harness would leave the project with no bridge registry, so its deps resolve from npmjs (`ERR_PNPM_NO_MATCHING_VERSION` on the `0.0.0-commit.<sha>` version). Always verify a fresh build of the branch, not a stale published commit.
 

.github/scripts/test-pkg-pr-new-migrate.sh

@@ -256,28 +256,22 @@ echo "  vite-plus spec: $commit_version"
 echo "  vite spec: $vite_core_spec"
 "$vp_bin" --version
 
-# Remove the existing root lockfile and root node_modules so migrate's reinstall
-# resolves from scratch. A stale pre-migrate lockfile can keep an optional-peer
-# copy of vite-plus pinned to an older published version (e.g. a nested oxlint's
-# `vite-plus: '*'` peer pulled in transitively by vite-plugin-checker/nuxt),
-# which the `--no-frozen-lockfile` reinstall preserves rather than deduping,
-# leaving `vp why` reporting two vite-plus versions. A clean install lets pnpm
-# resolve that optional peer to the in-tree managed version. node_modules is
-# gitignored; tracked lockfiles are regenerated by the migrate reinstall.
-#
-# Only the WORKSPACE ROOT is cleared. Sub-package node_modules are left in place:
-# in a pnpm/npm/yarn monorepo they are symlinks/hoisted from the root store and
-# the reinstall refreshes them, so wiping them is unnecessary and slow on large
-# monorepos.
+# Install the project's committed dependencies before migrating, as a user
+# upgrading would have them. `vp migrate` reads the original Vitest version from
+# the lockfile or node_modules, and blocks the Vitest 5 migration without them.
+# The install runs without the preview overrides so it reproduces the original
+# dependency tree. A project without a usable lockfile falls back to a regular
+# install.
 echo
-echo "Clearing root lockfile and node_modules in $project_dir for a clean migrate install"
-rm -f "$project_dir/pnpm-lock.yaml" \
-  "$project_dir/package-lock.json" \
-  "$project_dir/npm-shrinkwrap.json" \
-  "$project_dir/yarn.lock" \
-  "$project_dir/bun.lock" \
-  "$project_dir/bun.lockb"
-rm -rf "$project_dir/node_modules"
+echo "Installing the committed dependencies in $project_dir before migrating"
+install_status=0
+(cd "$project_dir" && env -u VP_VERSION -u VP_OVERRIDE_PACKAGES "$vp_bin" install --frozen-lockfile) ||
+  install_status=$?
+if [ "$install_status" -ne 0 ]; then
+  echo "warning: frozen install failed (exit $install_status); retrying without --frozen-lockfile" >&2
+  (cd "$project_dir" && env -u VP_VERSION -u VP_OVERRIDE_PACKAGES "$vp_bin" install) ||
+    echo "warning: could not install the committed dependencies; migrating anyway" >&2
+fi
 
 echo
 echo "Running vp migrate in $project_dir"