ci(release): reconcile lockfile before gated changeset commands (#1104)

* ci(release): reconcile lockfile before gated changeset commands

verifyDepsBeforeRun: error gates pnpm run/exec. The frozen install in the release job does not refresh the lockfile's overrides hash, so a lockfile whose overrides drifted from pnpm-workspace.yaml passes the frozen install but trips the gate on `pnpm run changeset:version` / `pnpm changeset publish`, killing every release before it versions or publishes. A non-frozen install is not gated and reconciles the hash; changesets/action commits the result, self-healing the repo.

* ci(release): reconcile lockfile inside the changeset command, not as a prior step

changesets/action does git checkout changeset-release/main + git reset --hard right before running the version/publish command, so any reconcile placed in an earlier workflow step is discarded by that reset and the gated 'pnpm changeset' call still trips verifyDepsBeforeRun. Move the non-frozen install into a single non-gated node entrypoint the action invokes, so it runs after the action's git work and immediately before the gated pnpm call. Drop the now-unreferenced changeset:version script.

* style: format

* ci(release): use --prefer-frozen-lockfile for the reconcile

changeset publish rebuilds packages via prepublishOnly at pack time. A non-frozen reconcile could re-resolve in-range transitive deps so shipped bits diverge from tested bits. prefer-frozen reconciles the deps state to satisfy verifyDepsBeforeRun without re-resolving when the lockfile is satisfiable, and falls back to a full install (e.g. after changeset version bumps workspace versions) when it isn't.

* ci(release): revert reconcile to --no-frozen-lockfile

The PR's purpose is to reliably clear ERR_PNPM_VERIFY_DEPS_BEFORE_RUN. --no-frozen-lockfile is pnpm's documented remediation and unconditionally refreshes the deps-state hash. --prefer-frozen-lockfile's fast path is gated by a satisfiability check that may not include the settings hash, so it could skip the rewrite in exactly the stale-metadata case this fixes. The shipped-vs-tested concern that motivated prefer-frozen is low-probability, pre-existing, and negligible when the lockfile is satisfiable (no re-resolution occurs).

---------

Co-authored-by: emdashbot[bot] <emdashbot[bot]@users.noreply.github.com>

Author: ascorbic

.github/scripts/release.mjs

@@ -0,0 +1,28 @@
+import { execFileSync } from "node:child_process";
+
+const mode = process.argv[2];
+
+const run = (args) => execFileSync("pnpm", args, { stdio: "inherit" });
+
+// changesets/action runs `git checkout changeset-release/main` + `git reset
+// --hard` immediately before this, which can leave the deps state out of
+// sync with pnpm-workspace.yaml. The next gated pnpm call
+// (verifyDepsBeforeRun: error) would then abort the release. `pnpm install`
+// is not gated, so reconcile here, after the action's git work and before
+// any `pnpm changeset` call. Do not hoist this into an earlier workflow
+// step: the action's git reset runs after workflow steps and undoes it.
+// Must be --no-frozen-lockfile, not --prefer-frozen-lockfile: prefer-frozen
+// can take the lockfile fast path and skip rewriting the stale deps-state
+// hash, which is the exact condition that trips the gate.
+run(["install", "--no-frozen-lockfile"]);
+
+if (mode === "version") {
+	run(["changeset", "version"]);
+	run(["install", "--no-frozen-lockfile"]);
+} else if (mode === "publish") {
+	run(["changeset", "publish"]);
+} else {
+	throw new Error(
+		`Unknown release mode: ${JSON.stringify(mode)} (expected "version" or "publish")`,
+	);
+}

.github/workflows/release.yml

@@ -71,16 +71,16 @@ jobs:
         id: changesets
         uses: changesets/action@63a615b9cd06ba9a3e6d13796c7fbcb080a60a0b # v1.8.0
         with:
-          version: pnpm run changeset:version
-          publish: pnpm changeset publish
+          version: node .github/scripts/release.mjs version
+          publish: node .github/scripts/release.mjs publish
           commit: "ci: release"
           title: "ci: release"
         env:
           GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
 
       - name: Publish (manual)
         if: ${{ inputs.publish-only }}
-        run: pnpm changeset publish
+        run: node .github/scripts/release.mjs publish
 
   sync-templates:
     name: Sync Templates

package.json

@@ -28,8 +28,7 @@
 		"screenshots": "node scripts/screenshot-all-templates.mjs",
 		"query-counts": "node scripts/query-counts.mjs",
 		"locale:extract": "pnpm --filter @emdash-cms/admin locale:extract",
-		"locale:compile": "pnpm --filter @emdash-cms/admin locale:compile",
-		"changeset:version": "pnpm changeset version && pnpm install --no-frozen-lockfile"
+		"locale:compile": "pnpm --filter @emdash-cms/admin locale:compile"
 	},
 	"keywords": [],
 	"author": "Matt Kane",