Fix CI build: allow dependency build scripts (pnpm v11 allowBuilds)

[FlazeIGuess]

Problem

With #180 merged, the [master] Release build now gets past the overrides error and fails at the next step, Install dependencies:

[ERR_PNPM_IGNORED_BUILDS] Ignored build scripts: @biomejs/biome@1.9.4, electron@38.8.6, esbuild@0.27.1
Run "pnpm approve-builds" to pick which dependencies should be allowed to run scripts.

Cause

pnpm v10+ blocks dependency build scripts by default for security. The CI installs pnpm@latest (currently v11) via pnpm/action-setup@v4, which requires an explicit allow-list. In pnpm v11 this is the allowBuilds map in pnpm-workspace.yaml (pnpm even writes a stub prompting set this to true or false for each package). Without it, the install aborts with exit 1.

Fix

Add allowBuilds to pnpm-workspace.yaml with the three packages that ship postinstall scripts set to true:

allowBuilds:
 "@biomejs/biome": true
 electron: true
 esbuild: true

Verification

On a clean checkout (empty node_modules), mirroring CI:

• CI=true pnpm install --frozen-lockfile -> exit 0 (all three postinstalls run: electron, esbuild, biome)
• pnpm run build -> exit 0 (injector + luna.dev/lib/ui built)

pnpm-lock.yaml is unchanged, so no relock is needed.

Note: the root cause of this and #180 is that the workflow installs pnpm@latest, so each pnpm behavior change can break CI. Pinning pnpm (e.g. a packageManager field or a fixed version: in the workflow) would prevent future surprises. Happy to send that as a follow-up if wanted.

[github-actions]

Flake Review Results for #181

Available systems: aarch64-darwin, aarch64-linux, armv6l-linux, armv7l-linux, i686-linux, powerpc64le-linux, riscv64-linux, x86_64-darwin, x86_64-freebsd, x86_64-linux
Requested systems: aarch64-darwin, x86_64-linux

🔄 Modified (2)

• ✅ packages.aarch64-darwin.default

  • Output: /nix/store/j1vigsrzgm2mla1rxw6phqw4qpqmx2kz-tidal-2.41.3
  Derivation diff

  - /nix/store/nxz7hs6qbkf7rs0sg2qhh51b3n0r895z-tidal-2.41.3.drv:{out}
  + /nix/store/ybrjcw9yh4817h5zqg64rxwx2v544m35-tidal-2.41.3.drv:{out}
  • The input derivation named `TidaLuna-1.16.0-beta` differs
    - /nix/store/p81yyqly40acznyykclg22dyv8ha00m5-TidaLuna-1.16.0-beta.drv:{out}
    + /nix/store/mns1dpp1z9zkmc4hbc3j5hqvhcxx037p-TidaLuna-1.16.0-beta.drv:{out}
    • The set of input source names do not match:
        - cplrwqgbsd17hlhh79psmqyrcjlcjfx2-source
        + nz0znry25n2qbi1mwjgg7x50dcjaqp8j-source
    • The input derivation named `TidaLuna-pnpm-deps` differs
      - /nix/store/fqqn4gnb3q6238s5l68y3aq7f5y5ngj2-TidaLuna-pnpm-deps.drv:{out}
      + /nix/store/h8ycwwrq1829hlaycibi687kj6h1yj5p-TidaLuna-pnpm-deps.drv:{out}
      • The set of input source names do not match:
          - cplrwqgbsd17hlhh79psmqyrcjlcjfx2-source
          + nz0znry25n2qbi1mwjgg7x50dcjaqp8j-source
      • The environments do not match:
          src=''
          /nix/store/f8ywlvnnrqf3fwjr5q0h29f6sqkb16g5-cplrwqgbsd17hlhh79psmqyrcjlcjfx2-source/nix/store/4igm78j1fxqixscqgzywc69gbx6wlzn7-nz0znry25n2qbi1mwjgg7x50dcjaqp8j-source
      ''
    • Skipping environment comparison
  • Skipping environment comparison

• ✅ packages.x86_64-linux.default

  • Output: /nix/store/bgx3fq0mppnbz31wyzd7phdgdp872sb2-tidal-hifi-6.3.1-Mavy
  Derivation diff

  - /nix/store/02598alzqyjrb36600m33v3xznrwmj7c-tidal-hifi-6.3.1-Mavy.drv:{out}
  + /nix/store/cnhg5z1hfr6i75v3rcn893hnhg20678f-tidal-hifi-6.3.1-Mavy.drv:{out}
  • The input derivation named `TidaLuna-1.16.0-beta` differs
    - /nix/store/qb5wfx5805diyx1mkqyfxq4q6vfyg2p6-TidaLuna-1.16.0-beta.drv:{out}
    + /nix/store/3l0jjc7i0mqrsqhfn8n3ppg0r1h8b6nl-TidaLuna-1.16.0-beta.drv:{out}
    • The set of input source names do not match:
        - cplrwqgbsd17hlhh79psmqyrcjlcjfx2-source
        + nz0znry25n2qbi1mwjgg7x50dcjaqp8j-source
    • The input derivation named `TidaLuna-pnpm-deps` differs
      - /nix/store/rbaz7wdpm0mmszlqc4zij5yhpnb1akqa-TidaLuna-pnpm-deps.drv:{out}
      + /nix/store/rzahk902ixp1kr592m4vr5bnl3gsvv0f-TidaLuna-pnpm-deps.drv:{out}
      • The set of input source names do not match:
          - cplrwqgbsd17hlhh79psmqyrcjlcjfx2-source
          + nz0znry25n2qbi1mwjgg7x50dcjaqp8j-source
      • The environments do not match:
          src=''
          /nix/store/f8ywlvnnrqf3fwjr5q0h29f6sqkb16g5-cplrwqgbsd17hlhh79psmqyrcjlcjfx2-source/nix/store/4igm78j1fxqixscqgzywc69gbx6wlzn7-nz0znry25n2qbi1mwjgg7x50dcjaqp8j-source
      ''
    • Skipping environment comparison
  • Skipping environment comparison

---

Generated by flake-review