code-be-01
8d27e0f78c
ci/woodpecker/pr/ci Pipeline was successful
Pipeline 2648 failed build-gateway with ERR_PNPM_OUTDATED_LOCKFILE
although publish-next-npm completed green and restored the workspace
byte-exact ('git diff clean' in its own log). Root cause: build-gateway
and publish-next-npm both depend on [build, verify] and run
concurrently; kaniko's COPY of apps/gateway/package.json raced inside
publish's in-place mutation window (transform .. publish .. restore).
PR 1405's snapshot/restore governs the END state of its own step only —
no mutual exclusion against a concurrent reader.
The snapshot/restore set was already a superset of the transform's
write set (both derive from apps/packages/plugins with the same
exclusions — the tasking's apps-coverage hypothesis is refuted by the
committed find). The defect is ordering, so the fix is a DAG edge:
build-gateway, build-appservice, and build-web each gain
publish-next-npm in depends_on, serializing every kaniko workspace
consumer after the restore. publish-npm (main-only, transform is
next-only) is unchanged. The invariant is stated inline at each edge:
any new workspace-consuming step must depend on publish-next-npm.
Red-first evidence (clean clone of next; scripts from the committed
YAML; gateway manifest as the demonstration case): pre-fix DAG shows
build-gateway deps == publish deps (concurrent); post-fix adds the
edge. Reading apps/gateway/package.json mid-window shows
0.0.3-next.2648 pins (the 2648 dump shape) and pnpm install
--frozen-lockfile fails ERR_PNPM_OUTDATED_LOCKFILE; the same read
after restore shows workspace:^ and the identical clean tree installs
rc=0. Closes #1411 (blocks PR 1401's merge — USC chain).