Error on yarn install if the lockfile is out of date #453

jmorrell · 2017-07-19T23:51:39Z

This switches to using --frozen-lockfile for yarn installs, which will fail the build if yarn.lock does not match the requirements listed in package.json. Under our current setup Yarn will install the updated dependencies as if the lockfile doesn't exist in this case, which could lead to unexpected failures at runtime.

With this change it will fail the build and print out a helpful message in this case.

Example log and error message:

-----> Creating runtime environment
       
       NPM_CONFIG_LOGLEVEL=error
       NPM_CONFIG_PRODUCTION=true
       NODE_VERBOSE=false
       NODE_ENV=production
       NODE_MODULES_CACHE=true

-----> Installing binaries
       engines.node (package.json):  unspecified
       engines.npm (package.json):   unspecified (use default)
       engines.yarn (package.json):  unspecified (use default)
       
       Resolving node version 6.x via semver.io...
       Downloading and installing node 6.11.1...
       Using default npm version: 3.10.10
       Resolving yarn version (latest)...
       Downloading and installing yarn (0.28.1)...
       Installed yarn 0.28.1

-----> Restoring cache
       Skipping cache restore (not-found)

-----> Building dependencies
       Installing node modules (yarn.lock)
       yarn install v0.28.1
       [1/4] Resolving packages...
       error Your lockfile needs to be updated, but yarn was run with `--frozen-lockfile`.
       info Visit https://yarnpkg.com/en/docs/cli/install for documentation about this command.

-----> Build failed

 !     Outdated Yarn lockfile

       Your application contains a Yarn lockfile: yarn.lock which does not match
       the requirements in your package.json file. This can happen if you use
       npm to install or update a dependency instead of Yarn.

       Please run the following command in your application directory and check
       in the new yarn.lock file:

       $ yarn install
       $ git add yarn.lock
       $ git commit -m "Updated Yarn lockfile"
       $ git push heroku master
    
       https://kb.heroku.com/why-is-my-node-js-build-failing-because-of-an-outdated-yarn-lockfile

jmorrell · 2017-07-20T01:08:44Z

Tests are currently failing because yarn fails on unknown command line flags, so I need to avoid passing in --frozen-lockfile for yarn versions older than X. Will fix.

jmorrell · 2017-07-21T00:03:40Z

lib/dependencies.sh

@@ -59,12 +59,28 @@ log_build_scripts() {
  fi
 }

+yarn_supports_frozen_lockfile() {


@dzuelke Mind critiquing my bash here?

jmorrell · 2017-07-21T00:04:40Z

lib/dependencies.sh

+yarn_supports_frozen_lockfile() {
+  local yarn_version="$(yarn --version)"
+  # Yarn versions lower than 0.19 will crash if passed --frozen-lockfile
+  if [[ "$yarn_version" =~ ^0\.(16|17|18).*$ ]]; then


List of all the yarn versions we support: https://nodebin.herokai.com/v1/yarn/linux-x64.txt

dzuelke

Bash functions can return exit codes like a normal program. So you can return 0 to indicate success, and any other code to indicate failure. Running if against this then works without [ or [[. You can also just use the true and false shorthands if they're the last statement, as the return code of a function will be its last statement. If you didn't need the mcount … call, the last statement could thus also just be [[ ! "$yarn_version" =~ ^0\.(16|17|18).*$ ]]

dzuelke · 2017-07-21T00:43:50Z

lib/dependencies.sh

+  # Yarn versions lower than 0.19 will crash if passed --frozen-lockfile
+  if [[ "$yarn_version" =~ ^0\.(16|17|18).*$ ]]; then
+    mcount "yarn.doesnt-support-frozen-lockfile"
+    echo false


Use return 1, or just false, without echo

dzuelke · 2017-07-21T00:43:58Z

lib/dependencies.sh

+    mcount "yarn.doesnt-support-frozen-lockfile"
+    echo false
+  else
+    echo true


Use return 0, or just true, without echo

dzuelke · 2017-07-21T00:45:09Z

lib/dependencies.sh


  echo "Installing node modules (yarn.lock)"
  cd "$build_dir"
-  yarn install --pure-lockfile --ignore-engines 2>&1
+  if [ "$supports_frozen_lockfile" = true ]; then


if yarn_supports_frozen_lockfile; then (and, generally, always use [[ with if if you require statements inside)

dzuelke · 2017-07-21T00:49:45Z

lib/dependencies.sh

 yarn_node_modules() {
  local build_dir=${1:-}
+  local supports_frozen_lockfile=$(yarn_supports_frozen_lockfile)


You don't need that one; see below

jmorrell · 2017-07-21T01:57:56Z

If you didn't need the mcount … call, the last statement could thus also just be [[ ! "$yarn_version" =~ ^0.(16|17|18).*$ ]]

I see how I could simplify to that, but I like the clarity of the more verbose option. Thanks for the insights @dzuelke!

hunterloftis

Looks good to me, just requested a tweak in the explanation text.

hunterloftis · 2017-07-21T16:51:16Z

lib/failure.sh

+    echo ""
+    warn "Outdated Yarn lockfile
+
+       Your application contains a Yarn lockfile: yarn.lock which does not match


Parentheses might fit the grammar here better than a colon:

Your application contains a Yarn lockfile; yarn.lock which does not match the requirements in your package.json file.

vs:

Your application contains a lockfile (yarn.lock) which does not match the dependencies in package.json.

jmorrell · 2017-07-24T17:40:12Z

updated wording 👍 @hunterloftis

hone · 2017-07-24T21:14:01Z

Thanks for getting this change in! sorry for not reviewing it sooner.

vlad-elagin · 2017-08-07T14:31:02Z

Hello.
Can't get my app working with error listed by topic-starter. I tried to delete and re-create lockfile, but without success. Can you help me with this? If so, what information should I provide?

hone · 2017-08-07T16:43:30Z

@vlad-elagin hi, can you provide your package.json and yarn.lock?

vlad-elagin · 2017-08-07T18:12:44Z

Thanks for response! Here they are.

yarn.zip

vlad-elagin · 2017-08-08T14:07:34Z

I've got it working, thanks.

Error on yarn install if the lockfile is out of date

88cb5c5

jmorrell requested a review from hone July 19, 2017 23:51

Update error message

a8e1700

This was referenced Jul 19, 2017

Error and fail the build if yarn.lock is out of date. #349

Closed

Install with "frozen" package-json npm/npm#17703

Open

Hopefully fix tests

3841f65

jmorrell requested a review from hunterloftis July 21, 2017 00:03

jmorrell commented Jul 21, 2017

View reviewed changes

dzuelke reviewed Jul 21, 2017

View reviewed changes

Cleanup bash code

b1b6d35

hunterloftis suggested changes Jul 21, 2017

View reviewed changes

Improve warning message

0f7c26d

hunterloftis approved these changes Jul 24, 2017

View reviewed changes

jmorrell merged commit c02a4b9 into master Jul 24, 2017

jmorrell deleted the yarn-lockfile-out-of-date branch July 24, 2017 19:49

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Error on yarn install if the lockfile is out of date #453

Error on yarn install if the lockfile is out of date #453

jmorrell commented Jul 19, 2017

jmorrell commented Jul 20, 2017

jmorrell Jul 21, 2017

jmorrell Jul 21, 2017

dzuelke left a comment

dzuelke Jul 21, 2017

dzuelke Jul 21, 2017

dzuelke Jul 21, 2017

dzuelke Jul 21, 2017

jmorrell commented Jul 21, 2017

hunterloftis left a comment

hunterloftis Jul 21, 2017

jmorrell commented Jul 24, 2017

hone commented Jul 24, 2017

vlad-elagin commented Aug 7, 2017

hone commented Aug 7, 2017

vlad-elagin commented Aug 7, 2017

vlad-elagin commented Aug 8, 2017

Error on yarn install if the lockfile is out of date #453

Error on yarn install if the lockfile is out of date #453

Conversation

jmorrell commented Jul 19, 2017

jmorrell commented Jul 20, 2017

jmorrell Jul 21, 2017

Choose a reason for hiding this comment

jmorrell Jul 21, 2017

Choose a reason for hiding this comment

dzuelke left a comment

Choose a reason for hiding this comment

dzuelke Jul 21, 2017

Choose a reason for hiding this comment

dzuelke Jul 21, 2017

Choose a reason for hiding this comment

dzuelke Jul 21, 2017

Choose a reason for hiding this comment

dzuelke Jul 21, 2017

Choose a reason for hiding this comment

jmorrell commented Jul 21, 2017

hunterloftis left a comment

Choose a reason for hiding this comment

hunterloftis Jul 21, 2017

Choose a reason for hiding this comment

jmorrell commented Jul 24, 2017

hone commented Jul 24, 2017

vlad-elagin commented Aug 7, 2017

hone commented Aug 7, 2017

vlad-elagin commented Aug 7, 2017

vlad-elagin commented Aug 8, 2017