fix(lambda-nodejs): run beforeInstall hook after workspace files are written#37899
Open
Zelys-DFKH wants to merge 2 commits into
Open
fix(lambda-nodejs): run beforeInstall hook after workspace files are written#37899Zelys-DFKH wants to merge 2 commits into
Zelys-DFKH wants to merge 2 commits into
Conversation
…written Splits the node-modules file-ops step into two phases — prepareSteps (writes pnpm-workspace.yaml, package.json, and the lockfile) and installSteps (runs the package manager and cleanup) — so that the beforeInstall command hook fires between them. Previously, beforeInstall ran before depsCommand, which meant CDK's empty pnpm-workspace.yaml write always silently overrode any allowBuilds entries a user appended there. This made the hook useless for pnpm v11 workspaces that need allowBuilds to permit native build scripts (e.g. cpu-features via ssh2-sftp-client). Fixes aws#37898. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
github-actions
Bot
added
bug
aws-cdk-automation
previously requested changes
May 17, 2026
…rdering Adds two layers of test coverage for the ordering fix from the previous commit: 1. E2e behavioral test in bundling-e2e.test.ts — asserts that allowBuilds written to pnpm-workspace.yaml by beforeInstall survives CDK's own workspace file setup. Runs under both local (skipped if pnpm absent) and Docker bundling. Closes the test gap that allowed the bug to exist. 2. CDK integration test (integ.dependencies-pnpm-before-install.ts) — deploys a Lambda that uses delay@5.0.0 with a beforeInstall hook writing to pnpm-workspace.yaml, exercising the full bundling pipeline. Snapshot hashes are placeholder (all-zeros); run `yarn integ` in framework-integ to regenerate from the Docker bundled output. Fixes aws#37898 Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
1 task
github-actions
Bot
added
the
effort/medium
aws-cdk-automation
dismissed
their stale review
✅ Updated pull request passes all PRLinter validations. Dismissing previous PRLinter review.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #37898.
Credit to @cmodijk: the issue report traces the execution order exactly, identifies the root cause, and spells out what the fix should look like. This PR implements what you described.
The problem
On pnpm v11,
strictDepBuildsis the effective default. AnyNodejsFunctionthat bundlesnodeModuleswith a native-build dependency (e.g.ssh2-sftp-client→cpu-features) hits this at deploy time:The
beforeInstallhook was designed to handle this: appendallowBuildsentries topnpm-workspace.yamlbefore the install runs. It silently doesn't work, which is worse than not existing.Why
CDK writes an empty
pnpm-workspace.yamlto prevent pnpm from walking up to a monorepo root (introduced in #21910, still the right call). The bug was ordering. Before this fix:Whatever the user wrote in
beforeInstallgot overwritten a step later. The hook's name is a lie.Fix
Splits node-modules file-ops into two phases via a new
NodeModuleFileOpsinterface:prepareSteps: writespnpm-workspace.yaml,package.json, and the lockfileinstallSteps: runs the package manager and post-install cleanupcreateBundlingStepsputsbeforeInstallbetween them, for both Docker and local bundling.No behavior change for callers where
beforeInstallreturns[](the default).The refactor makes
createBundlingStepsslightly more involved.dockerFileOpsandlocalFileOpsare both private, so there's no API surface change.Validation
Unit test (
bundling.test.ts):beforeInstall hook fires after pnpm workspace files are written (Docker)— asserts the Docker shell command orderspnpm-workspace.yamlwrite →beforeInstalloutput →pnpm install. This is the test that would have caught the bug.E2E behavioral test (
bundling-e2e.test.ts):pnpm-specific / beforeInstall writes to pnpm-workspace.yaml survive CDK workspace setup— runs CDK synthesis with a minimal pnpm project (local and Docker where available), writesallowBuilds:topnpm-workspace.yamlinbeforeInstall, then reads the output file and asserts the content survived. Skipped when pnpm is unavailable locally and Docker bundling is off.Integration test (
integ.dependencies-pnpm-before-install.ts): deploys a real Lambda with adelaydependency viaforceDockerBundling: true, wherebeforeInstallwritesallowBuilds: delay: truetopnpm-workspace.yaml. The snapshot ships with zeroed hashes: Docker + full CDK build aren't available in this environment. Regenerate with:Checklist
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license