ci: pin the three remaining check jobs to --frozen-lockfile - #299
Merged
Conversation
Closes cortexkit#295. check-plugin (48), check-pi-plugin (104), and check-dashboard (129) ran bare `bun install` while every later job used --frozen-lockfile. Per the issue thread this was drift, not policy: those three predate the May publish-gating rework that introduced the flag, and nobody decided the check jobs should float. bun.lock is committed, so the unpinned jobs were free to resolve outside it. Concretely, biome is declared ^2.5.1 in all four package manifests and pinned to 2.5.1 in the lockfile; an unpinned CI install floated it to 2.5.7, whose formatter disagrees. That produced Check (plugin) lint failures on files the PR under test never touched, with the same commit clean locally -- reproducible as 19 errors on 2.5.7 versus 1 on 2.5.1 against clean master. Verified on a clean upstream/master worktree that --frozen-lockfile installs successfully (1447 packages, exit 0), and that the resulting node_modules resolves biome 2.5.1 -- the version `biome check .` actually executes -- rather than the floated 2.5.7. Repo-wide lint passes under the pinned install. Tradeoff, per the issue: this gives up the incidental early-warning property of floating installs, in exchange for reproducible CI and toolchain upgrades landing as explicit lockfile commits.
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #295. One-line change ×3, off clean
master@328c0fdc.check-plugin(48),check-pi-plugin(104),check-dashboard(129) →bun install --frozen-lockfile, matching the four later jobs.Verification
On a clean
upstream/masterworktree:bun install --frozen-lockfilesucceeds — 1447 packages, exit 0. The lockfile is consistent with the manifests, so pinning does not break the install.node_modulesresolves biome 2.5.1 — the versionbiome check .actually executes — rather than the floated 2.5.7.bun run lintpasses under the pinned install.One detail worth recording, since it nearly misled me:
bunx @biomejs/biome --versionreports 2.5.7 even after a frozen install, becausebunxresolves from the registry rather thannode_modules. The lint scripts runbiome check .through the package's local binary, which is 2.5.1. So abunxprobe is the wrong instrument here —./node_modules/.bin/biome --versionis the one that reflects what CI runs.Tradeoff
As discussed on the issue: this gives up the incidental early-warning property of floating installs, in exchange for reproducible CI and toolchain upgrades landing as explicit lockfile commits. Flagging it in the commit message too so the reasoning is discoverable from
git logand not only from the issue thread.Need help on this PR? Tag
@codesmith-botwith what you need. Autofix is disabled.Summary by cubic
Pins the
check-plugin,check-pi-plugin, andcheck-dashboardCI jobs to usebun install --frozen-lockfile. This prevents dependency drift (e.g.,@biomejs/biome2.5.7 vs 2.5.1) and makes CI installs reproducible, addressing #295.Written for commit c0c63cb. Summary will update on new commits.
Greptile Summary
This PR makes the remaining three CI check jobs install dependencies from the committed Bun lockfile, preventing unreviewed dependency drift.
--frozen-lockfileto dependency installation incheck-plugin.check-pi-pluginandcheck-dashboard.Confidence Score: 5/5
The PR appears safe to merge because all three affected jobs can install from the consistent committed lockfile.
The change only enables Bun's frozen-lockfile enforcement for three root workspace installs, with no intervening manifest mutation and with equivalent frozen installs already used by sibling CI jobs.
Important Files Changed
Reviews (1): Last reviewed commit: "ci: pin the three remaining check jobs t..." | Re-trigger Greptile