fix(ci): pin Bit version in release bundles

[zkochan]

Summary

• install the exact Bit version selected by setup_bit_version
• prevent pnpm 12’s default 24-hour minimum release age from selecting an older Bit release
• keep the minimum-release-age protection enabled for unrelated packages

Root cause

The bundle command used pnpm add @teambit/bit without a version. pnpm 12 therefore selected the newest mature release (2.0.85) instead of the newly published 2.2.1. That older release depends on the unavailable @teambit/harmony.content.cli-reference@2.0.1193, causing the CircleCI bundle jobs to fail.

Verification

• reproduced the unversioned install failure with pnpm 12.0.0-rc.7
• verified pnpm add "@teambit/bit@${BIT_VERSION}" installs 2.2.1 and resolves cli-reference@2.0.1210
• verified the Linux pnpm native binary is present
• parsed the CircleCI YAML and ran git diff --check

[qodo-free-for-open-source-projects]

PR Summary by Qodo

CI: pin Bit version during release bundle installs

🐞 Bug fix ⚙️ Configuration changes 🕐 Less than 10 minutes

AI Description

• Pin @teambit/bit to ${BIT_VERSION} in CircleCI bundle installs.
• Avoid pnpm 12 selecting an older “mature” Bit release due to minimum-release-age.
• Keep minimum-release-age behavior unchanged for all other dependencies.

Diagram

graph TD
  A["CircleCI config.yml"] --> B["bundle job"] --> C["setup_bit_version"] --> D["BIT_VERSION env"] --> E["pnpm add @teambit/bit@${BIT_VERSION}"] --> F[("npm registry")]

  subgraph Legend
    direction LR
    _cfg["CI config"] ~~~ _job["Job/step"] ~~~ _db[("Package registry")]
  end

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Disable/override pnpm minimum-release-age for Bit installs

• ➕ Keeps unversioned installs while still preferring newest releases
• ➕ May reduce need for explicit version pinning in the command
• ➖ Requires relying on pnpm-specific configuration/flags and their stability across versions
• ➖ Easier to accidentally broaden the scope to other packages, reducing supply-chain safety benefits

2. Use `pnpm add @teambit/bit@latest` (or dist-tag)

• ➕ Simple and still explicit about intent to install newest tagged release
• ➖ Still tag-driven rather than controlled by setup_bit_version output
• ➖ Does not guarantee the exact version expected by the pipeline when troubleshooting/regressing

Recommendation: Pinning @teambit/bit to ${BIT_VERSION} is the most reliable fix because it aligns the bundle job with the version computed by setup_bit_version and avoids pnpm 12’s maturity/minimum-age selection behavior. Alternatives either depend on pnpm policy knobs or weaken the guarantee of installing the exact intended Bit version.

Files changed (1) +3 / -1

Bug fix (1) +3 / -1

config.ymlPin Bit install to '${BIT_VERSION}' in bundle step +3/-1

Pin Bit install to '${BIT_VERSION}' in bundle step

• Replaces an unversioned 'pnpm add @teambit/bit' with 'pnpm add "@teambit/bit@${BIT_VERSION}"' for OS/CPU-specific bundle builds. Adds inline documentation explaining pnpm 12’s minimum-release-age behavior and why pinning is required for CI stability.

.circleci/config.yml

[qodo-free-for-open-source-projects]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

Tip of the day

💡 Did you know, you can copy the agent prompt from any finding and feed it to your IDE agent

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗