[Bug] Yarn install --immutable successful locally, fails in CI because of mismatched checksum when resolving a local file: protocol dependency

[jsamr]

• I'd be willing to implement a fix

Describe the bug

yarn install --immutable successful locally, fails in CI. According to CI logs, because of mismatched checksum when resolving a file: protocol local dependency. Here is the log:

  ➤ YN0000: │ @@ -3006,13 +3006,12 @@
  ➤ YN0000: │    linkType: hard
  ➤ YN0000: │  
  ➤ YN0000: │  "@formidable-webview/webshell@file:../core::locator=example%40workspace%3Apackages%2Fexample":
  ➤ YN0000: │    version: 1.0.2
  ➤ YN0028: │ -  resolution: "@formidable-webview/webshell@file:../core#../core::hash=c8892e&locator=example%40workspace%3Apackages%2Fexample"
  ➤ YN0028: │ +  resolution: "@formidable-webview/webshell@file:../core#../core::hash=a5513e&locator=example%40workspace%3Apackages%2Fexample"
  ➤ YN0000: │    peerDependencies:
  ➤ YN0000: │      react: "*"
  ➤ YN0000: │      react-native: "*"
  ➤ YN0028: │ -  checksum: 9ba47891214ac33cd10ce9c74d3f7dbb9ed2ca72c6508a6a91592bba1ce150db125d811be80d5032840f39042581aba81ca7849b0e61f8a59af4e8f48f8303c1
  ➤ YN0000: │    languageName: node
  ➤ YN0000: │    linkType: hard
  ➤ YN0000: │  
  ➤ YN0000: │  "@formidable-webview/webshell@workspace:packages/core":
  ➤ YN0000: │ 
  ➤ YN0028: │ The lockfile would have been modified by this install, which is explicitly forbidden.

Below is a recording of a terminal session in which:

• Git status shows the working directory is clean on dev/v2
• yarn install --immutable ends with status 0 (success)
• Git status shows working directory still clean
• Last commit is 27c650d95b3731c5b94ad3621ec75783badbde10

In Github Actions CI, yarn install --immutable fails with the same commit (27c650d95b3731c5b94ad3621ec75783badbde10). You can read the CI log here.

Since the step "yarn install --immutable" is the first step after cloning the git repository, I have high confidence that the working directory is clean at that moment.

The issue seems to be caused by a local dependency resolved with the file: protocol. I am using workspaces with hoistingLimits.

To Reproduce

Well, reproducing the CI build will be hard. You can inspect the project source though. This branch will not change and points to the referred commit:

git clone https://github.com/formidable-webview/webshell.git --branch yarn-bug

Environment if relevant (please complete the following information):

• OS:
  • local: Linux Manjaro
  • CI: Linux Ubuntu 18.04.5 LTS
• Node version:
  • local: v14.10.0
  • CI: v14.10.1
• Yarn version: 2.2.2-git.20200923.4db8dee4

[merceyz]

Change to the workspace: protocol, the file: protocol packs your workspace as a zip, so every change in core will generate a new checksum.

https://yarnpkg.com/features/workspaces/#workspace-ranges-workspace

[borekb]

I was also surprised by this behavior of the file: protocol and have created this feature request to possibly reconsider it: #3356.