From 8899d2ed1323e185d8572d2855f63da03da6e001 Mon Sep 17 00:00:00 2001
From: dev-hari-prasad <webdev.byhari@gmail.com>
Date: Mon, 7 Sep 2026 03:48:02 +0530
Subject: [PATCH 1/2] ci: make yarn install --immutable explicit in CI
 workflows

Yarn's enableImmutableInstalls already defaults to true when CI is set in the environment. Passing --immutable explicitly makes the intent clear and self-documenting in all CI workflows that invoke Yarn.
---
 .github/workflows/check-javascript-style.yml | 2 +-
 .github/workflows/run-feature-tests-epas.yml | 2 +-
 .github/workflows/run-feature-tests-pg.yml   | 2 +-
 .github/workflows/run-javascript-tests.yml   | 2 +-
 4 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/check-javascript-style.yml b/.github/workflows/check-javascript-style.yml
index 974501a1114..d70350ae2a6 100644
--- a/.github/workflows/check-javascript-style.yml
+++ b/.github/workflows/check-javascript-style.yml
@@ -28,7 +28,7 @@ jobs:
       - name: Install Node modules
         run: |
           cd web
-          yarn install
+          yarn install --immutable
 
       - name: Run the linter
         run: |
diff --git a/.github/workflows/run-feature-tests-epas.yml b/.github/workflows/run-feature-tests-epas.yml
index 3d0442aa8d7..8ed22316800 100644
--- a/.github/workflows/run-feature-tests-epas.yml
+++ b/.github/workflows/run-feature-tests-epas.yml
@@ -150,7 +150,7 @@ jobs:
       - name: Build the JS bundle
         run: |
           cd web
-          yarn install
+          yarn install --immutable
           yarn run bundle
 
       - name: Run the tests
diff --git a/.github/workflows/run-feature-tests-pg.yml b/.github/workflows/run-feature-tests-pg.yml
index 90900ced5d0..93e163cb665 100644
--- a/.github/workflows/run-feature-tests-pg.yml
+++ b/.github/workflows/run-feature-tests-pg.yml
@@ -160,7 +160,7 @@ jobs:
       - name: Build the JS bundle
         run: |
           cd web
-          yarn install
+          yarn install --immutable
           yarn run bundle
 
       - name: Run the tests
diff --git a/.github/workflows/run-javascript-tests.yml b/.github/workflows/run-javascript-tests.yml
index 6648aafc42e..9a990c7ee83 100644
--- a/.github/workflows/run-javascript-tests.yml
+++ b/.github/workflows/run-javascript-tests.yml
@@ -37,7 +37,7 @@ jobs:
       - name: Install Node modules
         run: |
           cd web
-          yarn install
+          yarn install --immutable
 
       - name: Run the tests
         run: |

From 2ecb4a4ed8c155ed975cd86622fb71e92903b6c8 Mon Sep 17 00:00:00 2001
From: dev-hari-prasad <webdev.byhari@gmail.com>
Date: Thu, 10 Sep 2026 22:32:22 +0530
Subject: [PATCH 2/2] build: add --immutable to yarn install across build
 scripts and Dockerfile

Enforce immutable lockfile installs in Makefile, Dockerfile, and packaging scripts (pip, linux, mac) so release and local build processes fail if yarn.lock is modified instead of silently rewriting it.
---
 Dockerfile                   | 2 +-
 Makefile                     | 2 +-
 pkg/linux/build-functions.sh | 2 +-
 pkg/mac/build-functions.sh   | 2 +-
 pkg/pip/build.sh             | 2 +-
 5 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index 6d0bf273a93..d4e2cb08625 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -42,7 +42,7 @@ RUN --mount=type=bind,source=.git,target=/pgadmin4/.git \
     export CPPFLAGS="-DPNG_ARM_NEON_OPT=0" && \
     npm install -g corepack && \
     corepack enable && \
-    yarn install && \
+    yarn install --immutable && \
     yarn run bundle && \
     rm -rf yarn.lock \
            package.json \
diff --git a/Makefile b/Makefile
index 8865a41f87d..3303a535889 100644
--- a/Makefile
+++ b/Makefile
@@ -25,7 +25,7 @@ appbundle:
 	./pkg/mac/build.sh $(BUILD_OPTS)
 
 install-node:
-	cd web && yarn install
+	cd web && yarn install --immutable
 
 install-python:
 	./tools/setup-python-env.sh
diff --git a/pkg/linux/build-functions.sh b/pkg/linux/build-functions.sh
index f0947f9e52d..823974eb0e9 100644
--- a/pkg/linux/build-functions.sh
+++ b/pkg/linux/build-functions.sh
@@ -304,7 +304,7 @@ _copy_code() {
             exit 1
         fi
         yarn set version "${YARN_VERSION}"
-        yarn install
+        yarn install --immutable
         yarn run bundle
     popd > /dev/null || exit
 
diff --git a/pkg/mac/build-functions.sh b/pkg/mac/build-functions.sh
index c5174e98a1b..10d2da47b90 100644
--- a/pkg/mac/build-functions.sh
+++ b/pkg/mac/build-functions.sh
@@ -308,7 +308,7 @@ _complete_bundle() {
             exit 1
         fi
         yarn set version "${YARN_VERSION}"
-        yarn install 2>&1
+        yarn install --immutable 2>&1
 
         # Record the source commit hash before the heavy lint/webpack
         # steps. `yarn run` needs node_modules so this runs after install,
diff --git a/pkg/pip/build.sh b/pkg/pip/build.sh
index 395b5624b6c..bed8ed8a3d5 100755
--- a/pkg/pip/build.sh
+++ b/pkg/pip/build.sh
@@ -62,7 +62,7 @@ if [ -z "${YARN_VERSION}" ]; then
     exit 1
 fi
 yarn set version "${YARN_VERSION}"
-yarn install
+yarn install --immutable
 yarn run bundle
 
 # Copy the commit_hash file, it doesn't show up in git ls-files