From ac3e8eeb7debffa3a7e5e17e4f87a176e2ae0abc Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jos=C3=A9=20Almeida?= Date: Sun, 3 May 2026 21:48:13 +0100 Subject: [PATCH] fix(release): pin optionalDependencies to bootstrap version in committed source MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit CI was failing because apps/cli/package.json declared optionalDependencies at 0.16.0 but only 0.0.0-bootstrap exists on npm for those packages. The lockfile couldn't resolve, and `pnpm install --frozen-lockfile` rejected the working tree. Pin optionalDependencies to 0.0.0-bootstrap in the committed source so the lockfile resolves cleanly. The release workflow now bumps them to the real version inside publish-npm.sh, just before publishing main kandev — at which point the matching @kdlbs/runtime-*@VERSION tarballs have already been published earlier in the same step. This avoids the chicken-and-egg where the prepare job tried to bump optional deps to a version that didn't yet exist on npm. Workflow changes: - prepare job: only bumps the main package version, not optional deps. - publish-npm.sh: rewrites optionalDependencies to $VERSION right before the main `npm publish`, after the 5 runtime packages have been published. The published kandev@X.Y.Z still has its optionalDependencies pinned to matching @kdlbs/runtime-*@X.Y.Z. Only the local source uses the bootstrap pin for development convenience. --- .github/workflows/release.yml | 17 +++-------- apps/cli/package.json | 10 +++--- apps/pnpm-lock.yaml | 56 ++++++++++++++++++++++++++++++++++ scripts/release/publish-npm.sh | 21 +++++++++++++ 4 files changed, 87 insertions(+), 17 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index a6b466271f..21f798f25a 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -139,23 +139,16 @@ jobs: exit 1 fi - - name: Bump version + optionalDependencies + - name: Bump version env: NEXT: ${{ steps.compute.outputs.version }} run: | set -euo pipefail + # Bump only the main version. optionalDependencies stay pinned to + # 0.0.0-bootstrap in the committed source — the publish-npm step + # rewrites them to the real version in-flight before publishing, + # once the matching @kdlbs/runtime-* tarballs actually exist on npm. (cd apps/cli && npm version --no-git-tag-version "$NEXT") - node -e " - const fs = require('fs'); - const path = 'apps/cli/package.json'; - const pkg = JSON.parse(fs.readFileSync(path, 'utf8')); - if (pkg.optionalDependencies) { - for (const k of Object.keys(pkg.optionalDependencies)) { - pkg.optionalDependencies[k] = '$NEXT'; - } - } - fs.writeFileSync(path, JSON.stringify(pkg, null, 2) + '\n'); - " pnpm -C apps install --no-frozen-lockfile - name: Generate CHANGELOG diff --git a/apps/cli/package.json b/apps/cli/package.json index 00509bc7bd..a545526b7f 100644 --- a/apps/cli/package.json +++ b/apps/cli/package.json @@ -17,11 +17,11 @@ "npm": ">=7" }, "optionalDependencies": { - "@kdlbs/runtime-linux-x64": "0.16.0", - "@kdlbs/runtime-linux-arm64": "0.16.0", - "@kdlbs/runtime-darwin-x64": "0.16.0", - "@kdlbs/runtime-darwin-arm64": "0.16.0", - "@kdlbs/runtime-win32-x64": "0.16.0" + "@kdlbs/runtime-linux-x64": "0.0.0-bootstrap", + "@kdlbs/runtime-linux-arm64": "0.0.0-bootstrap", + "@kdlbs/runtime-darwin-x64": "0.0.0-bootstrap", + "@kdlbs/runtime-darwin-arm64": "0.0.0-bootstrap", + "@kdlbs/runtime-win32-x64": "0.0.0-bootstrap" }, "dependencies": { "tar": "^7.5.11", diff --git a/apps/pnpm-lock.yaml b/apps/pnpm-lock.yaml index 334ee5a1af..fd80492793 100644 --- a/apps/pnpm-lock.yaml +++ b/apps/pnpm-lock.yaml @@ -52,6 +52,22 @@ importers: vitest: specifier: ^1.6.0 version: 1.6.1(@types/node@20.19.28)(happy-dom@20.8.9)(lightningcss@1.30.2) + optionalDependencies: + '@kdlbs/runtime-darwin-arm64': + specifier: 0.0.0-bootstrap + version: 0.0.0-bootstrap + '@kdlbs/runtime-darwin-x64': + specifier: 0.0.0-bootstrap + version: 0.0.0-bootstrap + '@kdlbs/runtime-linux-arm64': + specifier: 0.0.0-bootstrap + version: 0.0.0-bootstrap + '@kdlbs/runtime-linux-x64': + specifier: 0.0.0-bootstrap + version: 0.0.0-bootstrap + '@kdlbs/runtime-win32-x64': + specifier: 0.0.0-bootstrap + version: 0.0.0-bootstrap packages/theme: dependencies: @@ -1636,6 +1652,31 @@ packages: '@jridgewell/trace-mapping@0.3.31': resolution: {integrity: sha512-zzNR+SdQSDJzc8joaeP8QQoCQr8NuYx2dIIytl1QeBEZHJ9uW6hebsrYgbz8hJwUQao3TWCMtmfV8Nu1twOLAw==} + '@kdlbs/runtime-darwin-arm64@0.0.0-bootstrap': + resolution: {integrity: sha512-i3H7KOcw5m1KEhXhTSa9+jNBlAh0Vc8NVkiGL9BpKB5n/COrhBol7YcN1WNkxs/6WdpD9LFo2My+51wODrC9tQ==} + cpu: [arm64] + os: [darwin] + + '@kdlbs/runtime-darwin-x64@0.0.0-bootstrap': + resolution: {integrity: sha512-ia8qU58B1pWr2AM9/qsPP514L6SftSYYmbFG49kcWNZMpRhosdbKNm1GfDce4yE+MKeOpmLmjPu/pR7ZnyMJpg==} + cpu: [x64] + os: [darwin] + + '@kdlbs/runtime-linux-arm64@0.0.0-bootstrap': + resolution: {integrity: sha512-m3UUB0GYOKNVwgW8wwdsjV6dFFmTYxI9vmLMtvgWz01GW1y+Ms5YSRhb0RT5NRMvYpn7xDntlJCjtPATE+RZ7A==} + cpu: [arm64] + os: [linux] + + '@kdlbs/runtime-linux-x64@0.0.0-bootstrap': + resolution: {integrity: sha512-XpcVCGngqq9wsZR2OASQwCiylTFUVD7iDoqeeWUuzZZ1wRxdGqYNV31xrEciq+96O/pI+dn5zWgbMYQEXc309w==} + cpu: [x64] + os: [linux] + + '@kdlbs/runtime-win32-x64@0.0.0-bootstrap': + resolution: {integrity: sha512-x/KRLCugV2eOLCJQWTUmBGU08rz7ep83GdTNZLeyQ3UmOKErVARk5eC9lWNO8LnlQr8LbahK9KdRW6Jhieee2A==} + cpu: [x64] + os: [win32] + '@lezer/common@1.5.0': resolution: {integrity: sha512-PNGcolp9hr4PJdXR4ix7XtixDrClScvtSCYW3rQG106oVMOOI+jFb+0+J3mbeL/53g1Zd6s0kJzaw6Ri68GmAA==} @@ -8099,6 +8140,21 @@ snapshots: '@jridgewell/resolve-uri': 3.1.2 '@jridgewell/sourcemap-codec': 1.5.5 + '@kdlbs/runtime-darwin-arm64@0.0.0-bootstrap': + optional: true + + '@kdlbs/runtime-darwin-x64@0.0.0-bootstrap': + optional: true + + '@kdlbs/runtime-linux-arm64@0.0.0-bootstrap': + optional: true + + '@kdlbs/runtime-linux-x64@0.0.0-bootstrap': + optional: true + + '@kdlbs/runtime-win32-x64@0.0.0-bootstrap': + optional: true + '@lezer/common@1.5.0': {} '@lezer/common@1.5.1': {} diff --git a/scripts/release/publish-npm.sh b/scripts/release/publish-npm.sh index eed0225cdf..5bf62cb682 100755 --- a/scripts/release/publish-npm.sh +++ b/scripts/release/publish-npm.sh @@ -104,6 +104,27 @@ for pkg in "${RUNTIME_PACKAGES[@]}"; do fi done +# -- Pin optionalDependencies before publishing main kandev ------------------ +# +# In committed source, optionalDependencies reference 0.0.0-bootstrap so the +# lockfile resolves during normal development. For the published kandev@VERSION +# package, we want optionalDependencies to point at @kdlbs/runtime-*@VERSION +# so users get matching runtime bundles. The runtime packages were just +# published above, so this version exists on npm now. +log "Pinning optionalDependencies to $VERSION before publishing main package..." +node -e " + const fs = require('fs'); + const path = '$ROOT_DIR/apps/cli/package.json'; + const pkg = JSON.parse(fs.readFileSync(path, 'utf8')); + if (pkg.optionalDependencies) { + for (const k of Object.keys(pkg.optionalDependencies)) { + pkg.optionalDependencies[k] = '$VERSION'; + } + } + fs.writeFileSync(path, JSON.stringify(pkg, null, 2) + '\n'); +" +log_ok "optionalDependencies pinned to $VERSION" + # -- Publish main kandev package ---------------------------------------------- echo