fix(pnpm-build): run dedupe --check after install, not before #67

Merged

Michael.Seele merged 1 commit from fix/pnpm-build-dedupe-order into main

2026-08-05 05:20:08 +00:00

Michael.Seele commented

2026-08-04 16:36:28 +00:00

Owner

Problem

pnpm-build's Build step runs pnpm dedupe --check before pnpm install. On a fresh checkout (no node_modules yet), dedupe --check writes node_modules/.pnpm-workspace-state-v1.json as a side effect even though it never links any packages. The subsequent pnpm install --frozen-lockfile then reads that marker, believes the install is already up to date, and skips linking entirely — silently leaving node_modules empty.

This surfaced downstream as sh: 1: biome: not found in a consumer repo's CI (biome is a devDependency that was simply never installed), even though the lockfile and scripts were correct.

Reproduced locally against a real consumer repo:

rm -rf node_modules
pnpm dedupe --check   # passes, but writes node_modules/.pnpm-workspace-state-v1.json
pnpm install --frozen-lockfile
# → "Already up to date. Done in 70ms" — node_modules/.bin/biome never created

Fix

Reorder the Build step so pnpm install runs first, and pnpm dedupe --check runs afterward against the fully-linked node_modules (which is also more semantically correct — dedupe-check is meant to validate an existing install, not a bare checkout). Verified locally that this ordering installs devDependency binaries correctly and dedupe --check still passes.

Status

Marking as WIP — please review the ordering/comment before merge, and let me know if you'd like a version bump / tag update strategy for pnpm-build-v1 once this lands.

## Problem `pnpm-build`'s `Build` step runs `pnpm dedupe --check` **before** `pnpm install`. On a fresh checkout (no `node_modules` yet), `dedupe --check` writes `node_modules/.pnpm-workspace-state-v1.json` as a side effect even though it never links any packages. The subsequent `pnpm install --frozen-lockfile` then reads that marker, believes the install is already up to date, and skips linking entirely — silently leaving `node_modules` empty. This surfaced downstream as `sh: 1: biome: not found` in a consumer repo's CI (`biome` is a devDependency that was simply never installed), even though the lockfile and scripts were correct. Reproduced locally against a real consumer repo: ``` rm -rf node_modules pnpm dedupe --check # passes, but writes node_modules/.pnpm-workspace-state-v1.json pnpm install --frozen-lockfile # → "Already up to date. Done in 70ms" — node_modules/.bin/biome never created ``` ## Fix Reorder the `Build` step so `pnpm install` runs first, and `pnpm dedupe --check` runs afterward against the fully-linked `node_modules` (which is also more semantically correct — dedupe-check is meant to validate an existing install, not a bare checkout). Verified locally that this ordering installs devDependency binaries correctly and `dedupe --check` still passes. ## Status Marking as WIP — please review the ordering/comment before merge, and let me know if you'd like a version bump / tag update strategy for `pnpm-build-v1` once this lands.

Michael.Seele added 1 commit

2026-08-04 16:36:28 +00:00

fix(pnpm-build): run dedupe --check after install, not before

validate-shared-actions / validate-shared-actions (pull_request) Successful in 27s

Details

Aikido Security PR Check / Aikido Security Scan (pull_request) Successful in 1m16s

Details

f9ed2b666c

pnpm dedupe --check writes node_modules/.pnpm-workspace-state-v1.json as a
side effect even when it doesn't link any packages (e.g. on a bare
checkout with no node_modules). A subsequent `pnpm install` then trusts
that marker and reports "Already up to date", skipping the real install
entirely and leaving node_modules empty (no devDependency binaries such
as biome). Reordering so install runs first, then dedupe --check
validates the fully-linked node_modules, avoids this.

Michael.Seele changed title from ~~WIP: fix(pnpm-build): run dedupe --check after install, not before~~ to fix(pnpm-build): run dedupe --check after install, not before

2026-08-04 16:37:33 +00:00

Michael.Seele requested review from Developers

2026-08-04 16:37:33 +00:00