Fix Dependabot PR Failures Due to Lockfile Mismatch

[JeremyDev87]

Fix Dependabot PR Failures Due to Lockfile Mismatch

Problem Statement

Dependabot PRs are failing in the codingbuddy-canary workflow at the "Install dependencies" step with the following error:

➤ YN0028: The lockfile would have been modified by this install, which is explicitly forbidden.

Root Cause Analysis

Why This Happens

1. Dependabot updates package.json but not yarn.lock

   • Unlike npm's package-lock.json, Yarn's lockfile is not automatically updated by Dependabot with default settings
   • This creates a mismatch between declared dependencies and locked versions

2. Inconsistent CI behavior between workflows

   Workflow	Install Condition	Result
   dev.yml	if: cache-hit != 'true'	Skips install when cache exists → Passes (incorrectly)
   canary.yml	Always runs	Detects mismatch → Fails

3. The --immutable flag rejects lockfile changes

   • This is correct behavior for CI environments
   • The problem is that Dependabot doesn't generate the updated lockfile

Evidence

Recent Dependabot commit f8f2755 (bump @anthropic-ai/sdk):

• Updated package.json: ^0.71.2 → ^0.72.1
• Did NOT update yarn.lock
• Result: canary.yml failed, dev.yml passed

Business Impact

• Blocked releases: Canary workflow runs on master branch, blocking automated releases
• False positives: dev.yml passes but lockfile is actually out of sync
• Manual intervention required: Each Dependabot PR needs manual yarn install and commit

Acceptance Criteria

1. Dependabot PRs include updated yarn.lock file
2. dev.yml fails when package.json and yarn.lock are out of sync
3. Both workflows behave consistently regarding lockfile validation

Technical Requirements

• Configure Dependabot to update lockfiles with versioning-strategy: increase
• Remove conditional install logic in dev.yml to always validate lockfile integrity
• Maintain --immutable flag for security (prevent accidental lockfile modifications in CI)

References

• Dependabot versioning-strategy documentation
• Yarn --immutable flag
• Failed workflow run: codingbuddy-canary on commit f8f2755