fix(release): write release artifacts to the repo-root dist by zkochan · Pull Request #12545 · pnpm/pnpm

zkochan · 2026-06-20T18:26:55Z

Summary

While checking the release pipeline after the pnpm11/ relocation (#12537), I found that pn copy-artifacts no longer writes to the directory the Release workflow reads from.

copy-artifacts.ts moved to pnpm11/__utils__/scripts/src/, so its import.meta.dirname + '../../..' now resolves to the pnpm11/ directory instead of the repository root. As a result:

dest became pnpm11/dist instead of the repo-root dist.

release.yml attests (subject-path: 'dist/*') and uploads (files: dist/*') from the repo-root dist. So a tagged release would publish to npm fine (those steps filter by package name) but produce a GitHub Release with no binary assets and a failing build-provenance attestation.

This restores repoRoot to the actual repository root and points the artifact source dirs at their new pnpm11/pnpm/ locations. The resolved artifactsDir/pnpmDistDir are unchanged; only dest is corrected back to the repo root.

The other pnpm release-related workflows (release.yml, create-release-pr.yml, update-latest.yml, docker.yml) were also reviewed and reference packages by name or already-updated pnpm11/... paths, so they remain correct.

Squash Commit Body

The TypeScript stack was relocated under pnpm11/ in pnpm/pnpm#12537, which
moved copy-artifacts.ts to pnpm11/__utils__/scripts/src/. Its
import.meta.dirname + '../../..' now resolved to the pnpm11/ directory
instead of the repository root, so `pn copy-artifacts` wrote the release
tarballs to pnpm11/dist.

The Release workflow attests (subject-path: 'dist/*') and uploads
(files: dist/*) from the repo-root dist, so a tagged release would have
produced a GitHub Release with no binary assets and a failing provenance
attestation, even though the npm publishes (filtered by package name)
still succeeded.

Resolve repoRoot to the actual repository root again and point the
artifact source directories at their new pnpm11/pnpm/ locations.

Checklist

The change is implemented in both the TypeScript CLI and the Rust pacquet/ port, or the description notes what still needs porting. (Release tooling only; no pacquet port needed.)
Added a changeset (pnpm changeset) if this PR changes any published package. (Internal release script in a private package; nothing published changes.)
Added or updated tests. (Not applicable — path fix in a release script.)
Updated the documentation if needed. (Not applicable.)

Written by an agent (Claude Code, claude-opus-4-8).

Summary by CodeRabbit

Chores
- Updated internal repository path references to reflect directory structure adjustments, ensuring proper artifact and distribution file handling in the build system.

The TypeScript stack was relocated under pnpm11/ in #12537, which moved copy-artifacts.ts to pnpm11/__utils__/scripts/src/. Its `import.meta.dirname` + '../../..' now resolves to the pnpm11/ directory instead of the repository root, so `pn copy-artifacts` wrote the release tarballs to pnpm11/dist. The Release workflow attests (`subject-path: 'dist/*'`) and uploads (`files: dist/*`) from the repo-root dist, so a tagged release would have produced a GitHub Release with no binary assets and a failing provenance attestation, even though the npm publishes (filtered by package name) still succeeded. Resolve repoRoot to the actual repository root again and point the artifact source directories at their new pnpm11/pnpm/ locations.

coderabbitai · 2026-06-20T18:27:09Z

📝 Walkthrough

Walkthrough

Three directory path constants in pnpm11/__utils__/scripts/src/copy-artifacts.ts are updated: repoRoot moves up one additional directory level (../../../..), and artifactsDir and pnpmDistDir are redirected from pnpm/artifacts and pnpm/dist to pnpm11/pnpm/artifacts and pnpm11/pnpm/dist.

Changes

Path Root Correction in copy-artifacts Script

Layer / File(s)	Summary
Update directory path constants `pnpm11/__utils__/scripts/src/copy-artifacts.ts`	`repoRoot` is adjusted to `../../../../`, and `artifactsDir` and `pnpmDistDir` now point to `pnpm11/pnpm/artifacts` and `pnpm11/pnpm/dist` respectively.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

Suggested labels

product: pnpm@11

✨ Finishing Touches

📝 Generate docstrings

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch fix/copy-artifacts-dist-repo-root

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 ESLint

If the error stems from missing dependencies, add them to the package.json file. For unrecoverable errors (e.g., due to private dependencies), disable the tool in the CodeRabbit configuration.

ESLint install failed. For unrecoverable errors, disable the tool in CodeRabbit configuration.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

qodo-free-for-open-source-projects · 2026-06-20T18:27:37Z

PR Summary by Qodo

Fix release artifact copying to write into repo-root dist/
🐞 Bug fix 🕐 Less than 10 minutes

Description

• Fix repoRoot resolution so release artifacts are copied to repo-root dist/.
• Update artifact source paths to match the new pnpm11/pnpm/ relocation.
• Restore compatibility with release.yml upload and provenance attestation (dist/*).

Diagram

graph TD
  A["copy-artifacts.ts"] --> B["Resolve repoRoot"] --> C["Source dirs: pnpm11/pnpm/*"] --> D[("repo-root dist/")] --> E["release.yml reads dist/*"]

High-Level Assessment

The following are alternative approaches to this PR:

1. Derive repo root via git (rev-parse)

➕ Robust to future file relocations
➕ Clearly defines "repo root" independent of relative paths
➖ Requires git to be available in the execution environment
➖ Adds process spawning + error handling complexity

2. Find repo root by walking up to a marker file (e.g., .git or package.json)

➕ No external process dependency
➕ More resilient than fixed relative traversal
➖ Slightly more code and runtime I/O
➖ Must pick and maintain an unambiguous marker file

Recommendation: Given this is internal release tooling and the relocation depth is well-defined, the current fix (adjusting the relative traversal and updating source paths) is the simplest and least fragile for the current repo layout. If the script is expected to move again, consider a marker-file walk-up approach to avoid repeat breakage.

Files changed (1) +3 / -3

Bug fix (1) +3 / -3

copy-artifacts.tsCorrect repoRoot and artifact source paths after pnpm11/ relocation +3/-3

Correct repoRoot and artifact source paths after pnpm11/ relocation
• Adjusts repoRoot traversal so the destination becomes the repository-root dist/ again (instead of pnpm11/dist). Updates artifacts and pnpm dist source directories to the new pnpm11/pnpm/* locations to keep the copy step functional.
pnpm11/utils/scripts/src/copy-artifacts.ts

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@pnpm11/__utils__/scripts/src/copy-artifacts.ts`:
- Around line 10-13: Add a regression test for the artifact path resolution in
the copy-artifacts script. The test should verify that when the copy-artifacts
functionality executes, it correctly resolves the repoRoot variable and places
artifacts in the repo-root dist directory rather than in pnpm11/dist. The test
should fail if the path resolution reverts to the broken behavior (using
relative paths instead of the corrected repoRoot-based paths shown in the diff).
Ensure the test validates both the source paths (artifactsDir and pnpmDistDir)
and destination path (dest) are correctly resolved relative to the repository
root.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 39907651-184b-4d46-a257-d3011302b74a

📥 Commits

Reviewing files that changed from the base of the PR and between f6dde62 and 8455790.

📒 Files selected for processing (1)

pnpm11/__utils__/scripts/src/copy-artifacts.ts

coderabbitai · 2026-06-20T18:28:45Z

+const repoRoot = path.join(import.meta.dirname, '../../../..')
 const dest = path.join(repoRoot, 'dist')
-const artifactsDir = path.join(repoRoot, 'pnpm/artifacts')
-const pnpmDistDir = path.join(repoRoot, 'pnpm/dist')
+const artifactsDir = path.join(repoRoot, 'pnpm11/pnpm/artifacts')
+const pnpmDistDir = path.join(repoRoot, 'pnpm11/pnpm/dist')


⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Add a regression test for repo-root dist/* artifact output.

This fixes a previously broken root resolution path, but there’s no regression test in the provided changes to lock the contract. Please add/adjust a test that fails with the old resolution and asserts tarballs are produced under repo-root dist/* (not pnpm11/dist/*).

As per coding guidelines, REVIEW_GUIDE.md (§7) explicitly requires a regression test for this repoRoot/artifactsDir resolution behavior.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@pnpm11/__utils__/scripts/src/copy-artifacts.ts` around lines 10 - 13, Add a regression test for the artifact path resolution in the copy-artifacts script. The test should verify that when the copy-artifacts functionality executes, it correctly resolves the repoRoot variable and places artifacts in the repo-root dist directory rather than in pnpm11/dist. The test should fail if the path resolution reverts to the broken behavior (using relative paths instead of the corrected repoRoot-based paths shown in the diff). Ensure the test validates both the source paths (artifactsDir and pnpmDistDir) and destination path (dest) are correctly resolved relative to the repository root.

Source: Coding guidelines

qodo-free-for-open-source-projects · 2026-06-20T18:28:57Z

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

Auto-approved notes
- no code review findings
- 'auto_approve_for_no_suggestions' flag enabled

Previous review results

Review updated until commit 8455790

Results up to commit 8455790

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

Auto-approved notes
- no code review findings
- 'auto_approve_for_no_suggestions' flag enabled

qodo-free-for-open-source-projects · 2026-06-20T18:30:46Z

Code review by qodo was updated up to the latest commit 8455790

no test needed for this

coderabbitai Bot added the product: pnpm@11 label Jun 20, 2026

coderabbitai Bot previously requested changes Jun 20, 2026

View reviewed changes

qodo-free-for-open-source-projects Bot approved these changes Jun 20, 2026

View reviewed changes

github-actions Bot added the reviewed: qodo label Jun 20, 2026

qodo-free-for-open-source-projects Bot approved these changes Jun 20, 2026

View reviewed changes

zkochan merged commit 6379dc1 into main Jun 20, 2026
27 checks passed

zkochan deleted the fix/copy-artifacts-dist-repo-root branch June 20, 2026 18:35

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

fix(release): write release artifacts to the repo-root dist#12545

fix(release): write release artifacts to the repo-root dist#12545
zkochan merged 1 commit into
mainfrom
fix/copy-artifacts-dist-repo-root

zkochan commented Jun 20, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Jun 20, 2026 •

edited

Loading

Walkthrough

Changes

Estimated code review effort

Suggested labels

Uh oh!

qodo-free-for-open-source-projects Bot commented Jun 20, 2026

Uh oh!

coderabbitai Bot left a comment

Uh oh!

coderabbitai Bot Jun 20, 2026

Uh oh!

qodo-free-for-open-source-projects Bot commented Jun 20, 2026 •

edited

Loading

Great, no issues found!

Uh oh!

qodo-free-for-open-source-projects Bot commented Jun 20, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Uh oh!

Conversation

zkochan commented Jun 20, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Squash Commit Body

Checklist

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Jun 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Estimated code review effort

Suggested labels

Uh oh!

qodo-free-for-open-source-projects Bot commented Jun 20, 2026

PR Summary by Qodo

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

coderabbitai Bot Jun 20, 2026

Choose a reason for hiding this comment

Uh oh!

qodo-free-for-open-source-projects Bot commented Jun 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Review by Qodo

Great, no issues found!

Previous review results

Great, no issues found!

Uh oh!

qodo-free-for-open-source-projects Bot commented Jun 20, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

zkochan commented Jun 20, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Jun 20, 2026 •

edited

Loading

qodo-free-for-open-source-projects Bot commented Jun 20, 2026 •

edited

Loading