build(pnpm): move devEngines onFail to warn so npm and action-setup both work - #340
Merged
Merged
Conversation
KaiSchwarz-cnic
marked this pull request as draft
August 28, 2026 19:59
…oth work devEngines.packageManager keeps the single-object form and moves from onFail "error" to "warn", matching the canonical value in .github/node-policy.conf in rtldev-middleware-workspace. "error" is what this field is for, and we do not get to have it. npm enforces the declaration against ITSELF on every command, not just install: with "error", `npm whoami` exits EBADDEVENGINES, and @semantic-release/npm calls exactly that in verifyConditions before it can authenticate. That made every publishing repository unreleasable the moment the field was adopted. The array form the spec allows — pnpm strictly plus npm by name — satisfies npm and was tried first. pnpm/action-setup cannot read it: its check is literally `devEngines.packageManager.name === "pnpm" && .version`, so an array falls through to "No pnpm version is specified" and nothing installs. True as of v6.0.10, the latest. So the object form is forced by action-setup and "warn" is forced by npm. pnpm now prints [WARN] rather than [ERROR] on a version outside the range and proceeds — the cost is recorded in node-policy.conf, and restoring "error" is filed separately. No lockfile change: the pnpm entry's name and version are untouched. RSRMID-3008
KaiSchwarz-cnic
force-pushed
the
RSRMID-3008/devengines-allow-npm
branch
from
August 28, 2026 20:19
86504ed to
29b9beb
Compare
KaiSchwarz-cnic
changed the title
KaiSchwarz-cnic
marked this pull request as ready for review
August 28, 2026 20:25
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-up on RSRMID-3008. Fixes a live breakage the strict form introduced.
The constraint
Two tools read
devEngines.packageManagerand they disagree about what may appear in it:npm(publishing)pnpm/action-setup(CI install)onFail: errorEBADDEVENGINESENEEDAUTHNo pnpm version is specifiedonFail: warnENEEDAUTHnpm enforces the declaration against itself, on every command — not just install. With
error, evennpm whoamiexitsEBADDEVENGINES, and@semantic-release/npmcalls exactly that inverifyConditionsbefore it can authenticate. That made every publishing repository unreleasable the moment the field was adopted.pnpm/action-setup reads only the object form. Its check is literally:
An array has no
.name, so it falls through and nothing installs. True as of v6.0.10, the latest.So the object form is forced by action-setup, and
warnis forced by npm. No single value keepserror.What it costs
Stated plainly, and recorded in
node-policy.confrather than left implicit: a container or runner on a pnpm outside the range now proceeds with a[WARN]instead of stopping. The weeklynode-policy-drift.ymlstill catches a manifest that disagrees with policy; nothing now catches a runtime on the wrong pnpm.Restoring
errorrequires the publishing repositories to stop invoking npm to publish — filed separately.Verification
All three rows above were run, not assumed. No lockfile change: the pnpm entry’s name and version are untouched.