Guard pnpm lockfiles against bot regeneration and pin the pnpm toolchain - #272
Merged
Conversation
CodeRabbit's auto-fix agent regenerated both lockfiles on PR #270, floating zod to v4 inside @polar-sh/sdk and breaking the API build. Path filters already excluded lockfiles from review but do not stop the fix agent from committing whatever its sandbox produces. - lockfile-guard workflow fails any PR where a pnpm-lock.yaml changes without its sibling package.json - packageManager pins pnpm@9.14.2 in api and web, and CI reads the pin via package_json_file instead of a loose version: 9 - CI installs use --frozen-lockfile so an out-of-sync lockfile fails at install time instead of being silently re-resolved - .coderabbit.yaml instructs the fix agent to never run installs or commit lockfile changes Closes #271 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Contributor
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (3)
📝 WalkthroughWalkthroughThe PR pins pnpm 9.14.2 in both packages, updates CI and Docker stages to use the pin, enforces frozen lockfile installs, adds lockfile validation, and updates CodeRabbit fix instructions. Changespnpm guardrails
Estimated code review effort: 2 (Simple) | ~10 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
Owner
Author
|
@coderabbitai full review |
Contributor
✅ Action performedFull review finished. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/lockfile-guard.yaml:
- Line 19: Update the actions/checkout reference in the workflow to use the full
immutable commit SHA corresponding to the intended v7 release, replacing the
mutable `@v7` tag while preserving the existing action step.
- Line 26: Update the workflow step containing the changed assignment to avoid
directly interpolating github.base_ref in shell source. Pass the base ref
through the step’s env configuration, then use the quoted shell environment
variable in the git diff command while preserving the existing comparison
behavior.
In `@api/package.json`:
- Line 8: Align both Dockerfiles with the manifest pnpm version: in
api/Dockerfile and web/Dockerfile, replace the npm-based pnpm@9 installation
with a direct pnpm@9.14.2 installation, ensuring no npm or yarn commands remain
in those Docker build paths.
🪄 Autofix (Beta)
✅ Autofix completed
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: 31da083b-0b96-4330-81e1-520aa1985c87
📒 Files selected for processing (6)
.coderabbit.yaml.github/workflows/api.yaml.github/workflows/lockfile-guard.yaml.github/workflows/web.yamlapi/package.jsonweb/package.json
Contributor
|
Note Autofix is a beta feature. Expect some limitations and changes as we gather feedback and continue to improve it. Fixes Applied SuccessfullyFixed 2 file(s) based on 3 unresolved review comments. Files modified:
Commit: The changes have been pushed to the Time taken:
Lines 16–29 runs-on: ubuntu-latest
steps:
- name: Checkout repository
- uses: actions/checkout@v7
+ uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
fetch-depth: 0
persist-credentials: false
- name: Fail if a lockfile changed without its package.json
+ env:
+ BASE_REF: ${{ github.base_ref }}
run: |
- changed="$(git diff --name-only "origin/${{ github.base_ref }}"...HEAD)"
+ changed="$(git diff --name-only "origin/$BASE_REF"...HEAD)"
failed=0
for app in api web; do
if grep -qx "$app/pnpm-lock.yaml" <<<"$changed" \ |
Fixed 2 file(s) based on 3 unresolved review comments. Co-authored-by: CodeRabbit <noreply@coderabbit.ai>
- pass github.base_ref through env instead of template interpolation so a crafted branch name cannot inject shell into the runner - pin actions/checkout in the new workflow to the v7 commit SHA - install pnpm@9.14.2 in both Dockerfiles via corepack instead of a loose npm install -g pnpm@9, so containers build with the same pnpm the manifests pin Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #271.
On PR #270, CodeRabbit's auto-fix commit regenerated both pnpm lockfiles, floating zod to 4.4.3 inside
@polar-sh/sdkand breaking the API build. The existingpath_filtersexclusion in.coderabbit.yamlkeeps lockfiles out of review comments but does not stop the fix agent from committing whatever its sandbox produces, so this adds layered guardrails:api/pnpm-lock.yamlorweb/pnpm-lock.yamlchanges without its siblingpackage.json. This is the deterministic stop, and it covers any actor, not just CodeRabbit."packageManager": "pnpm@9.14.2"in bothapi/package.jsonandweb/package.json. The CI workflows now read the pin viapackage_json_fileinstead of a looseversion: 9, so every environment resolves with the same pnpm.pnpm install --frozen-lockfilein the api and web workflows, so an out-of-sync lockfile fails at install time instead of being silently re-resolved..coderabbit.yamlnow tells the fix agent to never run installs or commit lockfile changes.Verified locally:
pnpm install --frozen-lockfilepasses in both packages with the pins in place (zero lockfile diff), all YAML parses, and the guard logic was exercised for both the failing case (lockfile alone) and the passing case (lockfile plus package.json).🤖 Generated with Claude Code
Summary by CodeRabbit