ci(publish): serialize workspace-consuming image builds after publish-next-npm (#1411) #1412

Merged

orch-01 merged 2 commits from t63-fix-2648 into next 2026-08-25 01:18:03 +00:00

Conversation 1 Commits 2 Files Changed 1

+61

2 Commits

Author	SHA1	Message	Date
code-be-01	8d27e0f78c	ci(publish): serialize workspace-consuming image builds after publish-next-npm (#1411) ... Pipeline 2648 failed build-gateway with ERR_PNPM_OUTDATED_LOCKFILE although publish-next-npm completed green and restored the workspace byte-exact ('git diff clean' in its own log). Root cause: build-gateway and publish-next-npm both depend on [build, verify] and run concurrently; kaniko's COPY of apps/gateway/package.json raced inside publish's in-place mutation window (transform .. publish .. restore). PR 1405's snapshot/restore governs the END state of its own step only — no mutual exclusion against a concurrent reader. The snapshot/restore set was already a superset of the transform's write set (both derive from apps/packages/plugins with the same exclusions — the tasking's apps-coverage hypothesis is refuted by the committed find). The defect is ordering, so the fix is a DAG edge: build-gateway, build-appservice, and build-web each gain publish-next-npm in depends_on, serializing every kaniko workspace consumer after the restore. publish-npm (main-only, transform is next-only) is unchanged. The invariant is stated inline at each edge: any new workspace-consuming step must depend on publish-next-npm. Red-first evidence (clean clone of next; scripts from the committed YAML; gateway manifest as the demonstration case): pre-fix DAG shows build-gateway deps == publish deps (concurrent); post-fix adds the edge. Reading apps/gateway/package.json mid-window shows 0.0.3-next.2648 pins (the 2648 dump shape) and pnpm install --frozen-lockfile fails ERR_PNPM_OUTDATED_LOCKFILE; the same read after restore shows workspace:^ and the identical clean tree installs rc=0. Closes #1411 (blocks PR 1401's merge — USC chain).	2026-08-24 19:40:24 -05:00
code-be-01	1a28212a89	fix(ci): restore workspace manifests after publish pin transform (#1404) ... PR #1400's transform rewrites package.json files in the shared pipeline workspace (pnpm publish reads the workspace manifests, so in-place is required) but did not restore them. build-gateway's kaniko build then COPYs the mutated manifests and its pnpm install --frozen-lockfile refuses: pnpm-lock.yaml still records workspace:^ while the manifest says 0.0.x-next.NNNN — ERR_PNPM_OUTDATED_LOCKFILE, next tip red (pipeline 2646). Fix (restore, chosen over tarball-scoped pack because pnpm publish must read the workspace tree anyway — a temp-copy pack would need to reconstruct the workspace linkage per package; restore is one cp per manifest and byte-exact): snapshot every publishable manifest to a step-local mktemp dir BEFORE the transform; after publish + the #1389 guard, restore byte-exact (cp -p preserves mtime), then a pristine guard runs git diff --exit-code over '**/package.json' and fails THIS step if any residual mutation remains — the #1404 class now fails in publish-next-npm with a named cause instead of surfacing as a frozen- lockfile error in build-gateway. Red-first control (scratch clone of next, real scripts extracted from the committed YAML): transform without restore -> git diff dirty (guard red) AND pnpm install --frozen-lockfile reproduces ERR_PNPM_OUTDATED_LOCKFILE verbatim (the 2646 failure class); with snapshot+restore -> git diff clean, frozen install rc=0. Also fixed a trailing space after the NODE heredoc opener introduced with #1400's edit that would have broken the heredoc invocation in real CI.	2026-08-24 18:38:52 -05:00