ci(lockfile): add drift detection workflow + outdated:check script - #246
Merged
Conversation
Refs § 6.10 of tech-debt-remediation plan. - New .github/workflows/lockfile-drift.yml runs on PRs + pushes to main when package.json, pnpm-lock.yaml, or pnpm-workspace.yaml change. Two-stage check: frozen install catches hard mismatches, then a regen diff catches cases where pnpm would silently rewrite the lockfile. - scripts/check-lockfile.js mirrors the workflow for pre-push feedback; wired as pnpm check:lockfile. - pnpm outdated:check surfaces stale deps across the workspace (truncated to 100 lines for scan-ability). - docs/ci-guardrails.md explains what the workflow does, how to fix a drift failure, and why reproducible builds matter.
h4yfans
added a commit
that referenced
this pull request
May 6, 2026
) Refs § 6.10 of tech-debt-remediation plan. - New .github/workflows/lockfile-drift.yml runs on PRs + pushes to main when package.json, pnpm-lock.yaml, or pnpm-workspace.yaml change. Two-stage check: frozen install catches hard mismatches, then a regen diff catches cases where pnpm would silently rewrite the lockfile. - scripts/check-lockfile.js mirrors the workflow for pre-push feedback; wired as pnpm check:lockfile. - pnpm outdated:check surfaces stale deps across the workspace (truncated to 100 lines for scan-ability). - docs/ci-guardrails.md explains what the workflow does, how to fix a drift failure, and why reproducible builds matter.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Refs § 6.10 of
.claude/plans/tech-debt-remediation.md(Phase 6 Unit U10).Summary
.github/workflows/lockfile-drift.ymlruns on PRs + pushes tomainwhen**/package.json,pnpm-lock.yaml, orpnpm-workspace.yamlchange. Two-stage check:pnpm install --frozen-lockfilecatches hard mismatches, then a regen diff catches the subtler case where pnpm would silently rewrite the lockfile on the next local install.scripts/check-lockfile.jsmirrors the CI workflow for pre-push feedback. Wired aspnpm check:lockfileat the repo root.pnpm outdated:checksurfaces stale workspace deps across the monorepo, truncated to 100 lines so the output is scan-able instead of a wall of text.docs/ci-guardrails.mddocuments what the workflow does, how to fix a drift failure, and why reproducible builds matter.Why
Lockfile drift = non-reproducible builds + "works on my machine" bugs. Today
--frozen-lockfilein every CI job already catches drift as an install error, but the signal is noisy and only fires when pnpm treats the mismatch as a hard error. The new workflow is dedicated, narrowly scoped to dep-file changes, and also catches the silent-rewrite case.Test plan
pnpm install --frozen-lockfilepasses locally.pnpm check:lockfilereportsLockfile is clean.on clean tree.pnpm-lock.yaml) → script exits 1 with actionable error; lockfile auto-restored.pnpm outdated:checkproduces truncated workspace-wide dep report.ci.ymlconventions (action versions, pnpm-setup-before-setup-node ordering so cache works).