Invariant: package-lock.json and bun.lock resolve the same dependency tree #104

Invariant

The repo carries two lockfiles. PR CI installs from bun.lock, but the npm release job installs from package-lock.json. They must resolve identical versions, or the published artifact is built from a tree CI never tested.

Where it's relied on

• PR CI, on macOS arm64: bun install --frozen-lockfile. See

  chart/.github/workflows/tests.yml

  Line 70 in 134f4c4

  - run: bun install --frozen-lockfile

  ,

  chart/.github/workflows/coverage.yml

  Line 39 in 134f4c4

  - run: bun install --frozen-lockfile

  and

  chart/.github/workflows/docs.yml

  Line 58 in 134f4c4

  - run: bun install --frozen-lockfile

• Release, on GitHub-hosted Ubuntu x64: npm ci, then npm publish runs prepublishOnly → npm test. See

  chart/.github/workflows/publish_npm.yml

  Line 60 in 134f4c4

  - run: npm ci

  and

  chart/.github/workflows/publish_npm.yml

  Line 96 in 134f4c4

  run: npm publish --workspace @bloxwap/chart --tag "$NPM_TAG" --provenance

• The README still describes "npm workspaces with one root lockfile":

  chart/README.md

  Line 73 in 134f4c4

  The repository uses npm workspaces with one root lockfile. Each workspace declares its own dependencies; the chart package has no runtime dependencies.

What breaks

If a dependency PR updates only one lockfile (common after #85 switched CI to Bun), PRs stay green while the release job builds with different tsrs, wabt, happy-dom or react versions. The release also builds on a different OS and architecture (Linux x64, using the @tsrs/linux-x64-gnu binary), so the first time that combination runs is at publish time. Failure modes:

• a red release that blocks a version tag;
• worse, a green release with different emit.

Why it's unenforced

Nothing compares the two lockfiles. I diffed them at this SHA and they agree: 0 packages only in one, 0 version mismatches. Today that holds only through discipline.

Suggested enforcement

Pick one:

• Add a CI-only check that parses both lockfiles and fails on any name or version mismatch (~30 lines of Node).
• Or run npm ci --dry-run / npm ci --ignore-scripts in PR CI.
• Or drop one lockfile and make the release job use bun install --frozen-lockfile too.

Also consider a periodic ubuntu-latest smoke job so the release platform is exercised before release day. None of this has a runtime cost.

Found in an invariant audit of main at 134f4c4. Repros ran against npm run build output (dist/) on Node 24.