Fix publish-preview to target only workspaces when adding resolutions

[mcmire]

When the publish-preview action runs for a monorepo, before it renames all packages to use the preview NPM scope, it adds resolutions for each package to ensure that imports and references to internal dependencies still work. For example, if @metamask/accounts-controller is present in the monorepo, before it is renamed to
@metamask-previews/accounts-controller, a resolution "@metamask/accounts-controller": "portal:./path/to/accounts-controller" will be added.

However, this resolution is too broad. If an external dependency relies on a different version of a package that exists in the monorepo, then it will be force-resolved to the version of that package in the monorepo instead of the old version. This can cause type errors in the later step of the publish-preview workflow that builds the monorepo, because it subverts an assumption that the code is making.

To fix this problem, this commit narrows each added resolution to the version of the corresponding monorepo package it is attempting to target.

References

• See this build failure which occurred while generating preview builds for a core PR. The controller that fails is unrelated to the changes made in the PR.

Manual testing

To reproduce the build failure above:

• Check out the branch for this PR in core: feat(kyc-controller): throw on previously silently handled errors core#10214
• Run the following command:

  resolutions="$(yarn workspaces list --no-private --json \
    | jq --slurp 'reduce .[] as $pkg ({}; .[$pkg.name] = "portal:./" + $pkg.location)')"
  jq --argjson resolutions "$resolutions" '.resolutions = ((.resolutions // {}) + $resolutions)' package.json > temp.json
  mv temp.json package.json
  

• Run yarn build -f. You should see a build error for keyring-controller.

To test the change introduced in this PR:

• Check out the branch for this PR in core: feat(kyc-controller): throw on previously silently handled errors core#10214
• Run the following command:

  workspace_list="$(yarn workspaces list --no-private --json \
    | jq --slurp --raw-output 'map([.location, .name]) | map(@tsv) | .[]')"
  resolutions='{}'
  while IFS=$'\t' read -r location name; do
    version="$(jq --raw-output '.version' "$location/package.json")"
    resolutions="$(jq \
      --arg name "$name" \
      --arg version "$version" \
      --arg location "$location" \
      '.[$name + "@^" + $version] = "portal:./" + $location' \
      <<< "$resolutions")"
  done <<< "$workspace_list"
  jq --argjson resolutions "$resolutions" '.resolutions = ((.resolutions // {}) + $resolutions)' package.json > temp.json
  mv temp.json package.json
  

• Run yarn build -f. You should not see any build errors.

---

Note

Low Risk
CI-only change to Yarn resolution keys in the preview publish workflow; no runtime product or auth logic is touched.

Overview
The publish-preview monorepo path no longer adds blanket Yarn resolutions like "@scope/pkg": "portal:./…", which could override external dependencies that happen to share a name with a workspace package but need a different version.

Resolutions are now keyed as name@^<workspaceVersion> per package, using each workspace’s version from its package.json, so only requests aligned with the monorepo copy are redirected to the local portal after preview renaming.

The workflow also computes workspace_list once and reuses it when building resolutions and when running prepare_manifest over workspaces, instead of invoking yarn workspaces list twice.

^{Reviewed by Cursor Bugbot for commit 837df87. Bugbot is set up for automated code reviews on this repo. Configure here.}