PR #1400's transform rewrites package.json files in the shared pipeline
workspace (pnpm publish reads the workspace manifests, so in-place is
required) but did not restore them. build-gateway's kaniko build then
COPYs the mutated manifests and its pnpm install --frozen-lockfile
refuses: pnpm-lock.yaml still records workspace:^ while the manifest
says 0.0.x-next.NNNN — ERR_PNPM_OUTDATED_LOCKFILE, next tip red
(pipeline 2646).
Fix (restore, chosen over tarball-scoped pack because pnpm publish
must read the workspace tree anyway — a temp-copy pack would need to
reconstruct the workspace linkage per package; restore is one cp per
manifest and byte-exact): snapshot every publishable manifest to a
step-local mktemp dir BEFORE the transform; after publish + the #1389
guard, restore byte-exact (cp -p preserves mtime), then a pristine
guard runs git diff --exit-code over '**/package.json' and fails THIS
step if any residual mutation remains — the #1404 class now fails in
publish-next-npm with a named cause instead of surfacing as a frozen-
lockfile error in build-gateway.
Red-first control (scratch clone of next, real scripts extracted from
the committed YAML): transform without restore -> git diff dirty
(guard red) AND pnpm install --frozen-lockfile reproduces
ERR_PNPM_OUTDATED_LOCKFILE verbatim (the 2646 failure class); with
snapshot+restore -> git diff clean, frozen install rc=0. Also fixed a
trailing space after the NODE heredoc opener introduced with #1400's
edit that would have broken the heredoc invocation in real CI.
code-be-01