From c0c63cb246cc6c79cf55e945f0438b74ae81d766 Mon Sep 17 00:00:00 2001 From: Tehan Date: Mon, 10 Aug 2026 16:19:09 +0200 Subject: [PATCH] ci: pin the three remaining check jobs to --frozen-lockfile Closes #295. check-plugin (48), check-pi-plugin (104), and check-dashboard (129) ran bare `bun install` while every later job used --frozen-lockfile. Per the issue thread this was drift, not policy: those three predate the May publish-gating rework that introduced the flag, and nobody decided the check jobs should float. bun.lock is committed, so the unpinned jobs were free to resolve outside it. Concretely, biome is declared ^2.5.1 in all four package manifests and pinned to 2.5.1 in the lockfile; an unpinned CI install floated it to 2.5.7, whose formatter disagrees. That produced Check (plugin) lint failures on files the PR under test never touched, with the same commit clean locally -- reproducible as 19 errors on 2.5.7 versus 1 on 2.5.1 against clean master. Verified on a clean upstream/master worktree that --frozen-lockfile installs successfully (1447 packages, exit 0), and that the resulting node_modules resolves biome 2.5.1 -- the version `biome check .` actually executes -- rather than the floated 2.5.7. Repo-wide lint passes under the pinned install. Tradeoff, per the issue: this gives up the incidental early-warning property of floating installs, in exchange for reproducible CI and toolchain upgrades landing as explicit lockfile commits. --- .github/workflows/ci.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 801a40191..3714658f5 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -45,7 +45,7 @@ jobs: node-version: "24" - name: Install dependencies - run: bun install + run: bun install --frozen-lockfile - name: TypeScript typecheck run: bun run typecheck @@ -101,7 +101,7 @@ jobs: bun-version: latest - name: Install dependencies - run: bun install + run: bun install --frozen-lockfile - name: TypeScript typecheck run: bun run --cwd packages/pi-plugin typecheck @@ -126,7 +126,7 @@ jobs: bun-version: latest - name: Install dependencies - run: bun install + run: bun install --frozen-lockfile # Frontend-only checks (no Rust/Tauri needed). The key gate is the test # step, which runs config-parity.test.ts — it fails the build if the