From 25c1111b27a0e561b7124220f353cab5cd2a88ac Mon Sep 17 00:00:00 2001 From: KeKs0r Date: Wed, 8 Jul 2026 18:52:53 +0200 Subject: [PATCH] fix(release): regenerate lockfile after version bump and guard it changeset version bumps package.json versions but never touches the lockfile. examples/* pin sibling chkit packages to exact published betas, so once the workspace version moves past that pin bun can no longer dedupe them onto the local copies and must record fresh registry resolutions. Without regenerating the lockfile, the release commit ships a stale one that CI's bun install --frozen-lockfile rejects on main. - Run bun install --lockfile-only right after version-packages so the release commit carries the updated resolutions. - Add bun install --frozen-lockfile to the release guards so a stale lockfile fails the release locally before it is pushed. --- scripts/manual-release.ts | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-) diff --git a/scripts/manual-release.ts b/scripts/manual-release.ts index ef3fddb..2b29341 100644 --- a/scripts/manual-release.ts +++ b/scripts/manual-release.ts @@ -8,7 +8,8 @@ * - default: enters beta prerelease mode if needed * - --stable: exits prerelease mode so versions graduate to GA * 3. Applies pending changesets (version bump) if they exist, - * or detects already-bumped versions from a prior run + * or detects already-bumped versions from a prior run, then + * regenerates the lockfile so it matches the bumped versions * 4. Runs quality gates (typecheck, lint, test, build) * 5. Runs release guards (internal workspace deps + packed tarballs) * 6. Publishes all public workspace packages via `bun publish`: @@ -192,6 +193,15 @@ function applyPendingChangesets(dryRun: boolean, stable: boolean): boolean { } runCommand('bun', ['run', 'version-packages']) + + // `changeset version` rewrites package.json versions but never touches the + // lockfile. examples/* pin sibling chkit packages to exact published betas, + // so once the workspace version moves past that pin bun can no longer dedupe + // them onto the local copies and must record fresh registry resolutions. + // Regenerate the lockfile here so the release commit carries them; otherwise + // CI's `bun install --frozen-lockfile` rejects the stale lockfile on main. + runCommand('bun', ['install', '--lockfile-only']) + return true } @@ -595,8 +605,12 @@ function runQualityGates(): void { */ function runReleaseGuards(): void { logLine( - 'Running release guards (internal workspace deps + packed tarballs)...', + 'Running release guards (lockfile + internal workspace deps + packed tarballs)...', ) + // Fail here if the committed lockfile does not satisfy the bumped versions — + // the same check CI runs on main. This catches a stale lockfile before the + // release is pushed rather than after. + runCommand('bun', ['install', '--frozen-lockfile']) runCommand('bun', ['run', 'check:workspace-deps']) runCommand('bun', ['run', 'check:packed-deps']) }