fix: also preserve relative symlinks in copy-artifacts.ts (release tarballs)#11408
Merged
Merged
Conversation
…rballs) pnpm#11399 fixed the fs.cpSync call in pnpm/artifacts/exe/scripts/build-artifacts.ts, which controls the dist/ shipped inside the npm-published @pnpm/exe package. But the GitHub release tarballs (pnpm-{darwin,linux}-{x64,arm64}.tar.gz) are produced by a different script — __utils__/scripts/src/copy-artifacts.ts, run via 'pn copy-artifacts' in the release workflow. That script has the same fs.cpSync(...) call without verbatimSymlinks: true, so the broken absolute symlinks under dist/node_modules/.bin/ pointing at /home/runner/work/pnpm/ pnpm/... still made it into the v11.0.2 GitHub release tarballs. Apply the same one-line fix to that script so the next release ships clean relative symlinks. Follow-up to pnpm#11398. 🤖 Generated with [Amp](https://ampcode.com) Amp-Thread-ID: https://ampcode.com/threads/T-019dda79-b947-742f-8711-b6f83bcda9ff Co-authored-by: Amp <amp@ampcode.com>
|
💖 Thanks for opening this pull request! 💖 |
Contributor
There was a problem hiding this comment.
Pull request overview
This PR fixes how the GitHub Release tarball artifacts are assembled by ensuring fs.cpSync preserves relative symlinks when copying pnpm/dist into the per-target artifact dist/ directory, preventing absolute /home/runner/... symlink targets from being baked into published archives.
Changes:
- Update
__utils__/scripts/src/copy-artifacts.tsto callfs.cpSyncwith{ verbatimSymlinks: true }. - Add a Changesets entry documenting the fix and its relation to the earlier incomplete fix in #11399.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
__utils__/scripts/src/copy-artifacts.ts |
Preserves relative symlinks during the dist/ copy step used to build GitHub release archives. |
.changeset/copy-artifacts-verbatim-symlinks.md |
Adds a patch-level Changesets note describing the release-tarball symlink preservation fix. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
zkochan
approved these changes
Apr 30, 2026
zkochan
pushed a commit
that referenced
this pull request
Apr 30, 2026
…rballs) (#11408) #11399 fixed the fs.cpSync call in pnpm/artifacts/exe/scripts/build-artifacts.ts, which controls the dist/ shipped inside the npm-published @pnpm/exe package. But the GitHub release tarballs (pnpm-{darwin,linux}-{x64,arm64}.tar.gz) are produced by a different script — __utils__/scripts/src/copy-artifacts.ts, run via 'pn copy-artifacts' in the release workflow. That script has the same fs.cpSync(...) call without verbatimSymlinks: true, so the broken absolute symlinks under dist/node_modules/.bin/ pointing at /home/runner/work/pnpm/ pnpm/... still made it into the v11.0.2 GitHub release tarballs. Apply the same one-line fix to that script so the next release ships clean relative symlinks. Follow-up to #11398. 🤖 Generated with [Amp](https://ampcode.com) Amp-Thread-ID: https://ampcode.com/threads/T-019dda79-b947-742f-8711-b6f83bcda9ff Co-authored-by: Amp <amp@ampcode.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-up to #11399 / #11398.
TL;DR
#11399 fixed the wrong file. The same one-line
verbatimSymlinks: truefix needs to be applied to__utils__/scripts/src/copy-artifacts.tsto actually clean up the GitHub release tarballs.Why #11399 wasn't enough
The pnpm release pipeline produces two distinct sets of artifacts that each have their own copy of
dist/:fs.cpSynclocation@pnpm/exepackagepn build→build-artifacts.tspnpm/artifacts/exe/scripts/build-artifacts.ts:48✅ fixed in #11399pnpm-{darwin,linux}-{x64,arm64}.tar.gz)pn copy-artifacts(inrelease.yml) →copy-artifacts.ts__utils__/scripts/src/copy-artifacts.ts:51❌ still brokenBoth files do roughly the same thing — copy
pnpmDistDirinto a per-targetdist/for archiving — butcopy-artifacts.tsis what actually creates the.tar.gzand.ziparchives uploaded to the GitHub release page.Verification
After #11399 merged and v11.0.2 was cut, I re-ran the original reproducer:
Same broken absolute symlinks as v11.0.0 / v11.0.1. Source maps timestamp confirms these are from the v11.0.2 build run.
The source code at the v11.0.2 tag has the
build-artifacts.tsfix applied correctly — but the release tarballs come fromcopy-artifacts.ts, which still has the unfixed call.Fix
Same rationale as #11399: Node's
fs.cpSyncdefaults toverbatimSymlinks: false, which resolves relative symlinks into absolute paths at the source filesystem location. On the GitHub Actions runner this rewrites the.binsymlinks to/home/runner/work/pnpm/...targets that ship verbatim in the tarball.Apologies
Sorry for the incomplete fix — I should have grepped for all
fs.cpSynccallers in the release pipeline before opening #11399, not just the one I'd already pinpointed in my issue. Confirmed viagrep -r 'fs\.cpSync'that these are now the only two callers and both haveverbatimSymlinks: trueafter this PR.🤖 Generated with Amp