ci: pin pnpm via packageManager to fix auto-update lockfile mismatch#465
Closed
mandarini wants to merge 1 commit into
Closed
ci: pin pnpm via packageManager to fix auto-update lockfile mismatch#465mandarini wants to merge 1 commit into
mandarini wants to merge 1 commit into
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
This pull request has been ignored for the connected project Preview Branches by Supabase. |
mandarini
force-pushed
the
fix/pin-pnpm-version-via-package-manager
branch
from
8cd4028 to
1bc1b7c
Compare
Coverage Report for CI Build 25678894493Warning No base build found for commit Coverage: 50.963%Details
Uncovered ChangesNo uncovered changes found. Coverage RegressionsRequires a base build to compare against. How to fix this → Coverage Stats
💛 - Coveralls |
Auto-update PRs for @supabase/supabase-js have been failing since 2026-05-08 with ERR_PNPM_LOCKFILE_CONFIG_MISMATCH. The update-supabase-js workflow regenerates the lockfile with pnpm 9, but website-tests uses pnpm "latest" (now 11.x), which writes a different overrides format and rejects the pnpm-9 lockfile under --frozen-lockfile. Pin both workflows to the same pnpm via the packageManager field in website/package.json. pnpm/action-setup reads it when no version: is set, so both jobs always agree on the pnpm version. Bump the lockfile to the pnpm-11 format and add pnpm-workspace.yaml allowBuilds entries for sharp, esbuild, and unrs-resolver — pnpm 11 errors on unapproved build scripts. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
mandarini
force-pushed
the
fix/pin-pnpm-version-via-package-manager
branch
from
1bc1b7c to
b27045f
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
@supabase/supabase-js(chore: update @supabase/supabase-js to v2.105.4 #460, do not merge #464) have been failing CI since 2026-05-08 withERR_PNPM_LOCKFILE_CONFIG_MISMATCH.update-supabase-js.ymlregenerates the lockfile with pnpm 9 whilewebsite-tests.yamlruns--frozen-lockfilewith pnpm latest (now 11.x). The two versions produce/expect differentoverrideslockfile shapes.packageManagerfield inwebsite/package.json.pnpm/action-setup@v6reads it when noversion:input is set, so both workflows always agree.website/pnpm-lock.yamlto the pnpm-11 format (drops top-leveloverrides:block, addslibc:on platform deps).website/pnpm-workspace.yamlwithallowBuilds:entries forsharp,esbuild,unrs-resolver— pnpm 11 errors on unapproved build scripts. Generated bypnpm approve-builds --all.Why pin via
packageManagerrather thanversion: latesteverywhereversion: latestis what caused this regression — pnpm shipped a new major and CI silently moved with it. Pinning makes pnpm upgrades a deliberate PR rather than a surprise breakage.Verification
cd website && CI=true pnpm install --frozen-lockfile✓ exits 0 locally on pnpm 11.0.8 (previously failed withERR_PNPM_LOCKFILE_CONFIG_MISMATCH)pnpm run test:run✓ passes inTZ=UTC(CI default). One pre-existing test in__tests__/search.integration.test.tsx:87is timezone-dependent and only passes in UTC — unrelated to this change.Test & Coverageon this PR will be the canonical check.Follow-up
Once this lands, open auto-update PRs #460 and #464 will need to be rebased on
masterto pick up the new workflow + lockfile shape.Test plan
Test & Coveragepasses on this PRupdate-supabase-jsworkflow_dispatch (any current version) and confirm the produced PR is green🤖 Generated with Claude Code