Fix - CI dependency install fails with pnpm 11 on Node 20 runners - #141
Merged
Merged
Conversation
There was a problem hiding this comment.
Copilot review overview
🟡 Changes recommended
Critical CI package-manager and build-script configuration issues remain unresolved.
Get a fresh assessment by requesting another Copilot review.
Review effort: Lite
Findings: 2
Open (2)
What changed in this PR
This pull request restores CI dependency installation on Node 20 by pinning pnpm and refreshing workspace metadata.
Changes:
- Pins pnpm to
9.15.9. - Adds root workspace configuration.
- Regenerates the pnpm lockfile.
The Build Testable ZIP workflow still uses npm without a lockfile, and the pnpm version is incompatible with the configured allowBuilds setting.
| File | Description |
|---|---|
pnpm-workspace.yaml |
Adds root workspace configuration. |
pnpm-lock.yaml |
Updates dependency snapshots and metadata. |
package.json |
Pins pnpm to 9.15.9. |
Files not reviewed (1)
- pnpm-lock.yaml: Generated file
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| @@ -1,5 +1,5 @@ | |||
| { | |||
| "packageManager": "pnpm@11.24.0", | |||
| "packageManager": "pnpm@9.15.9", | |||
| @@ -1,5 +1,5 @@ | |||
| { | |||
| "packageManager": "pnpm@11.24.0", | |||
| "packageManager": "pnpm@9.15.9", | |||
…ript allowlist key pnpm 9 doesn't gate install/postinstall scripts at all, so downgrading to it silently dropped the build-script allowlist protection pnpm 11 had (verified directly: pnpm 11 blocks an unlisted package's postinstall by default, pnpm 9 runs every package's scripts unconditionally). pnpm 10.34.5 declares the same Node >=18.12 compatibility as 9, so it still fixes the original CI failure, but keeps the same default-deny behavior as 11. Also switched pnpm-workspace.yaml from the pnpm 11-only "allowBuilds" map (confirmed not recognized by pnpm 10) to the documented, version-portable "onlyBuiltDependencies" array, which works correctly on both.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Changes proposed in this Pull Request:
The e2e test suite and the "Build Testable ZIP" workflow could not run on any pull request in this repo. Both failed at the dependency-install step with a Node.js error (), because the pinned package manager version (pnpm 11) requires a newer Node.js than what the CI runners provide. This fix pins back to a compatible pnpm version and updates the lockfile to match, so these checks can run again on this and future pull requests.
How to test the changes in this Pull Request:
Types of changes:
Other information:
Changelog entry
Fix - CI dependency install fails with pnpm 11 on Node 20 runners.