ci: make the CI install frozen so a stale lockfile fails instead of resolving - #59
Merged
Merged
Conversation
…esolving
Both installing jobs ran `pnpm install --frozen-lockfile=false`, which does not
merely omit a flag — it explicitly DISABLES a safety default. pnpm says so in
its own error text: "Note that in CI environments this setting is true by
default." Someone had to turn it off.
With it off, CI re-resolves rather than verifying. A dependency change
committed without its lockfile update installs cleanly here and produces a tree
that differs from every other machine, so the drift surfaces later and
somewhere else. That is the same shape as the bug this workflow just got split
to expose: a real problem that CI is structurally unable to report.
Frozen now, in both jobs.
Verified in three steps, because a gate that cannot fail is not a gate:
1. The committed lockfile is already in sync — `pnpm install --frozen-lockfile`
succeeds and reports "Lockfile is up to date, resolution step is skipped".
So this flip turns nothing red today.
2. The gate actually bites. Injecting an undeclared dependency into
package.json and re-running gives ERR_PNPM_OUTDATED_LOCKFILE, "specifiers
in the lockfile don't match specifiers in package.json". package.json was
restored and re-checked clean afterwards.
3. The full pipeline still passes on a frozen install: skills valid, audit
clean, build complete, 4 test suites passing.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KQPxAPY7KvsN9WLbdLSQED
Deploying with
|
| Status | Name | Latest Commit | Preview URL | Updated (UTC) |
|---|---|---|---|---|
| ✅ Deployment successful! View logs |
nyuchi-docs-mcp | f9fd0e7 | Commit Preview URL Branch Preview URL |
Aug 11 2026, 07:34 AM |
Deploying with
|
| Status | Name | Latest Commit | Preview URL | Updated (UTC) |
|---|---|---|---|---|
| ✅ Deployment successful! View logs |
shamwari-docs-ai | f9fd0e7 | Commit Preview URL Branch Preview URL |
Aug 11 2026, 07:34 AM |
Deploying with
|
| Status | Name | Latest Commit | Preview URL | Updated (UTC) |
|---|---|---|---|---|
| ✅ Deployment successful! View logs |
nyuchi-docs | f9fd0e7 | Commit Preview URL Branch Preview URL |
Aug 11 2026, 07:35 AM |
bryanfawcett
marked this pull request as ready for review
August 11, 2026 07:43
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-up to #58, which flagged this and deliberately left it alone.
=falsewas not an omissionBoth installing jobs ran
pnpm install --frozen-lockfile=false. That does not merely leave a flag off — it explicitly disables a safety default. pnpm says so in its own error text:Someone had to turn it off.
With it off, CI re-resolves instead of verifying. A dependency change committed without its lockfile update installs cleanly here and produces a tree that differs from every other machine — drift that surfaces later, somewhere else, with nothing pointing back at the commit that caused it. That is the same shape as the bug #58 was written to expose: a real problem CI is structurally unable to report.
Verification — a gate that cannot fail is not a gate
1. It turns nothing red today. The committed lockfile is already in sync:
2. It actually bites. Injecting an undeclared dependency into
package.jsonand re-running frozen:package.jsonwas restored and re-checked clean afterwards (git diff --quiet→ clean).3. The full pipeline passes on a frozen install:
skillsauditbuildbuild(test)What this means going forward
A dependency PR must now carry its lockfile update, or
buildfails with a message that names the mismatch. Combined with #58's split, the three failure modes are now independently reportable: a malformed skills bundle, an advisory, and a broken-or-drifted build no longer mask one another.🤖 Generated with Claude Code
https://claude.ai/code/session_01KQPxAPY7KvsN9WLbdLSQED
Generated by Claude Code