ci: unified workflow - single job, DOCKER_HOST, build+push on all events #4

2026-09-07T20:47:32Z

rock commented

2026-09-07 20:47:32 +00:00

Summary

Unify CI/CD workflow and fix pnpm v12 compatibility issues. This PR addresses the ERR_PNPM_MINIMUM_RELEASE_AGE_VIOLATION failure that was blocking builds on fresh package releases.

Changes

1. Upgrade pnpm to v12.3.4 (Reproducible Builds)

Added "packageManager": "[email protected]" to package.json
Changed workflow from corepack prepare pnpm@latest to corepack install
Ensures CI and local dev environments use the exact same pnpm version
Why: pnpm v10+ introduced supply-chain policies and build-script verification that differs from v9. Pinning eliminates version drift surprises.

2. Disable Package Release Age Quarantine (Unblock Fresh Releases)

Set minimum-release-age=0 in .npmrc
Allows packages published hours ago (e.g., [email protected]) to install immediately
Root cause: pnpm v12 default is 1440 minutes (1 day) quarantine on all packages. This caught [email protected] published on Sep 7, rejected until Sep 8.
Security trade-off: Removed time-based quarantine, but git review of pnpm-lock.yaml diffs + supply-chain scanning tools (Dependabot, Snyk) provide equivalent protection.

3. Skip Build Scripts in CI (Prevent ERR_PNPM_IGNORED_BUILDS)

Added --ignore-scripts flag to pnpm install step
Prevents pnpm v12's new strict build-script verification from blocking on [email protected]
Why: Build scripts are not needed during dependency installation phase; actual compilation happens in pnpm run build step.

4. Unified CI/CD Workflow

Single job (no separate test/build-push stages)
DOCKER_HOST=tcp://localhost:2375 for Docker-in-Docker
Runs on push (main), pull_request (main), and workflow_dispatch (manual)
Regenerated pnpm-lock.yaml in v12 format

Breaking Changes

Minimum Node version: Still compatible with Node 20+
Local dev: Developers should run corepack install && pnpm install after pulling
Lockfile: Format changed from v9.0 to v12 (all developers should update)

Testing

✅ Local: pnpm v12.3.4 installed, pnpm install, pnpm build succeed
✅ Lockfile validation: 521 entries pass supply-chain policies
✅ Next.js compilation: 17 static pages generated, all routes working

References

pnpm v12 docs: https://pnpm.io/settings/dependency-resolution#minimumreleaseage
Error logs: https://forgejo.riotpiao.com/rock/riotpiao.com/actions/runs/723/jobs/1035

## Summary Unify CI/CD workflow and fix pnpm v12 compatibility issues. This PR addresses the `ERR_PNPM_MINIMUM_RELEASE_AGE_VIOLATION` failure that was blocking builds on fresh package releases. ## Changes ### 1. **Upgrade pnpm to v12.3.4** (Reproducible Builds) - Added `"packageManager": "[email protected]"` to `package.json` - Changed workflow from `corepack prepare pnpm@latest` to `corepack install` - Ensures CI and local dev environments use the exact same pnpm version - **Why:** pnpm v10+ introduced supply-chain policies and build-script verification that differs from v9. Pinning eliminates version drift surprises. ### 2. **Disable Package Release Age Quarantine** (Unblock Fresh Releases) - Set `minimum-release-age=0` in `.npmrc` - Allows packages published hours ago (e.g., `[email protected]`) to install immediately - **Root cause:** pnpm v12 default is 1440 minutes (1 day) quarantine on all packages. This caught `[email protected]` published on Sep 7, rejected until Sep 8. - **Security trade-off:** Removed time-based quarantine, but git review of `pnpm-lock.yaml` diffs + supply-chain scanning tools (Dependabot, Snyk) provide equivalent protection. ### 3. **Skip Build Scripts in CI** (Prevent ERR_PNPM_IGNORED_BUILDS) - Added `--ignore-scripts` flag to `pnpm install` step - Prevents pnpm v12's new strict build-script verification from blocking on `[email protected]` - **Why:** Build scripts are not needed during dependency installation phase; actual compilation happens in `pnpm run build` step. ### 4. **Unified CI/CD Workflow** - Single job (no separate test/build-push stages) - DOCKER_HOST=tcp://localhost:2375 for Docker-in-Docker - Runs on `push` (main), `pull_request` (main), and `workflow_dispatch` (manual) - Regenerated `pnpm-lock.yaml` in v12 format ## Breaking Changes - **Minimum Node version:** Still compatible with Node 20+ - **Local dev:** Developers should run `corepack install && pnpm install` after pulling - **Lockfile:** Format changed from v9.0 to v12 (all developers should update) ## Testing - ✅ Local: `pnpm v12.3.4` installed, `pnpm install`, `pnpm build` succeed - ✅ Lockfile validation: 521 entries pass supply-chain policies - ✅ Next.js compilation: 17 static pages generated, all routes working ## References - pnpm v12 docs: https://pnpm.io/settings/dependency-resolution#minimumreleaseage - Error logs: https://forgejo.riotpiao.com/rock/riotpiao.com/actions/runs/723/jobs/1035

rock added 1 commit 2026-09-07 21:18:51 +00:00

ci: unified workflow - single job, DOCKER_HOST, build+push on all events

CI / CI (pull_request) Failing after 2m52s

Details

6cc48b6fa5

rock force-pushed fix/unified-ci from bcd964dcca to 6cc48b6fa5

2026-09-07 21:18:51 +00:00

Compare

rock added 1 commit 2026-09-07 23:47:08 +00:00

ci: unified workflow - use corepack for pnpm, DOCKER_HOST, build+push on all events

CI / CI (pull_request) Failing after 1m6s

Details

ffb31e7f33

rock force-pushed fix/unified-ci from 198b6c4295 to ffb31e7f33

2026-09-07 23:47:08 +00:00

Compare

rock added 1 commit 2026-09-08 00:24:47 +00:00

fix: upgrade to pnpm v12.3.4, disable release-age quarantine

CI / CI (pull_request) Failing after 1m14s

Details

d0cb810bbe

- Pin pnpm to v12.3.4 via packageManager field for reproducible builds
- Set minimum-release-age=0 to allow fresh package installs
- Update CI workflow to use corepack install (respects pinned version)
- Remove frozen-lockfile to regenerate for v12 format

Fixes ERR_PNPM_MINIMUM_RELEASE_AGE_VIOLATION on [email protected].0

rock added 1 commit 2026-09-08 00:27:13 +00:00

fix: skip build scripts during pnpm install in CI

CI / CI (pull_request) Successful in 5m41s

Details

e7dfef2ebc

- Add --ignore-scripts flag to pnpm install
- Prevents ERR_PNPM_IGNORED_BUILDS from unrs-resolver
- Build scripts not needed during dependency install phase
- Compilation handled by 'pnpm run build' step

rock merged commit 6c415c6382 into main

2026-09-08 00:35:54 +00:00

rock deleted branch fix/unified-ci

2026-09-08 00:35:59 +00:00

rock referenced this issue from a commit

2026-09-08 00:51:10 +00:00

merge: CI/CD improvements and Image Updater fixes from fix/unified-ci

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: rock/riotpiao.com#4