build: revisit build pipeline

.github/workflows/release.yml

@@ -238,7 +238,7 @@ jobs:
           corepack enable yarn
           corepack prepare --activate yarn@4
           yarn -v
-      - name: yarn install
+      - name: Setup subject
         run: yarn install --immutable
       - name: publish to registry as "${{ env.NPMJS_RELEASE_TAG }}"
         run: >

tools/write-dist-manifest.cjs

@@ -22,12 +22,13 @@ Copyright (c) OWASP Foundation. All Rights Reserved.
  * @internal
  */
 
-const { readFileSync, writeFileSync } = require('node:fs')
-const { dirname, join } = require('node:path')
+const { cpSync, readFileSync, writeFileSync } = require('node:fs')
+const { basename, dirname, join } = require('node:path')
 
 const projectRoot = join(__dirname, '..')
 
 const manifestSourceFile = join(projectRoot, 'package.json')
+const lockSourceFile = join(projectRoot, 'yarn.lock')
 
 const structuredClonePolyfill =
   typeof structuredClone === 'function'
@@ -54,16 +55,16 @@ function main (outputFile) {
   manifest.publishReplace = undefined
   // dist is expected to be a bundle - no deps need install
   manifest.dependencies = {}
-  // move deps to devDeps - for documentation purposes
+  // move deps to devDeps - for documentation purposes and release pipeline
   manifest.devDependencies = {
     ...manifestSource.dependencies,
     ...manifestSource.devDependencies,
   }
 
   writeFileSync(outputFile, JSON.stringify(manifest, undefined, 2))
 
-  // also write an empty yarn.lock
-  writeFileSync(join(dirname(outputFile), 'yarn.lock'), '')
+  // also copy the original yarn.lock
+  cpSync(lockSourceFile, join(dirname(outputFile), basename(lockSourceFile)))
 }
 
 if (require.main === module) {