ci: fix TS7 release pipeline (pin pnpm 11.10, restore age-gate excludes, bump actions) - #63
Merged
Conversation
The release pipeline broke after pnpm was bumped to 11.12.0: pnpm/action-setup's
npm-based self-installer crashes installing that version ("Cannot use 'in'
operator to search for 'integrity' in undefined").
- pnpm/action-setup 6.0.8 -> 6.0.9 + standalone: true (fetch the prebuilt
binary, bypassing the failing self-installer) -- the actual fix
- bump remaining pinned actions to latest: actions/checkout 6.0.2 -> 7.0.0,
changesets/action 1.8.0 -> 1.9.0, linear/linear-release-action 0.14.0 -> 0.14.5
(actions/setup-node already at 6.4.0)
- run the Verify job on pull_request (opened/synchronize/reopened) so
toolchain/CI changes are validated pre-merge; guard Version/Publish to
push/dispatch only so a passing PR Verify never triggers a release
pnpm stays at 11.12.0 (no revert).
|
Test whether v6.0.9's newer bootstrap (11.7.0) installs pnpm 11.12.0 via the plain path. standalone:true installed 11.12.0 fine but collided with the runner's pre-existing PNPM_HOME (v10 layout), breaking @pnpm/exe exec.
pnpm 11.12.0 breaks pnpm/action-setup's self-installer ('Cannot use in
operator ... integrity'). 11.10.0 is structurally identical to the
proven-good 11.9.0 (no optionalDependencies) and installs via action-setup.
Mirrors lifinance/sdk#428. The org's minimumReleaseAge supply-chain gate blocks the <24h-old @yuku / rolldown-plugin-dts@0.27.8 / tsdown@0.22.7 transitive deps pulled in by the TS7 toolchain. pnpm auto-generates this exclude block on install; keep it committed (it was wrongly reverted as an artifact) so 'pnpm install --frozen-lockfile' passes on CI and locally.
chybisov
changed the title
chybisov
added a commit
that referenced
this pull request
Jul 27, 2026
Bump dev tooling (biome 2.5.5, changesets 2.31.1, fs-extra 11.4.0, knip 6.29.0, tsdown 0.22.14, react/react-dom 19.2.8) and the @wallet-standard patch line. Five of seven Dependabot advisories clear from the lockfile refresh alone (brace-expansion, js-yaml x2, fast-uri). The remaining two are pinned by dependents that have not moved yet, so they need overrides: postcss by vite (dev only) and valibot by bitcoinjs-lib. tsdown 0.22.14 deprecates deps.skipNodeModulesBundle in favour of deps.neverBundle; the build emitted a warning for all three packages. Verified the emitted output still leaves dependencies external. Refresh minimumReleaseAgeExclude to the versions the lockfile now pins — every entry referred to the superseded tsdown 0.22.7 tree, and tsdown 0.22.14 is ~23h old, right at the gate that broke the release pipeline in #63. @noble/hashes 2.x is deliberately excluded, see PR description.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
The release pipeline broke on
mainafter #62's TS7 toolchain bump. Two independent causes, both now fixed by mirroring what lifinance/sdk#428 did:pnpm/action-setup's self-installer (Cannot use 'in' operator to search for 'integrity' in undefined). chore: adopt TypeScript 7 and refresh toolchain #62 bumped pnpm to 11.12.0; the SDK never touched its pnpm version.minimumReleaseAgesupply-chain gate blocks the <24h-old@yuku/rolldown-plugin-dts@0.27.8/tsdown@0.22.7transitive deps. pnpm auto-generates aminimumReleaseAgeExcludeblock for these; it was wrongly dropped from bigmi'spnpm-workspace.yaml(the SDK kept it).What
pnpm/action-setup(11.12.0 does not).minimumReleaseAgeExcludeinpnpm-workspace.yaml(same 26 entries the SDK committed) sopnpm install --frozen-lockfilepasses the gate — locally and in CI. Keeps the supply-chain guard intact (no disabling).actions/checkout6.0.2→7.0.0,changesets/action1.8.0→1.9.0,linear/linear-release-action0.14.0→0.14.5,pnpm/action-setup6.0.8→6.0.9 (actions/setup-nodealready latest).Verifyon PRs (opened/synchronize/reopened) + guardVersion/Publishto push/dispatch only — so toolchain/CI breaks are caught pre-merge, not onmain. This is why chore: adopt TypeScript 7 and refresh toolchain #62's break slipped through:Verifywas push-to-main only.Validation
Full
Verifygate is green on this PR's own CI run (Install · biome · circular-deps · knip · build · check:types · test), andVersion/Publish/Linear/Previewcorrectly skip on the PR. CI-only change — no publishable package affected, no changeset.