fix: fail when yarn.lock is updated in workspaces when --frozen-lockfile is used by robin-drexler · Pull Request #6554 · yarnpkg/yarn

robin-drexler · 2018-10-18T13:48:18Z

Summary
This PR is an attempt to fix that yarn does not fail when yarn.lock is updated in a workspace project although --frozen-lockfile is used

The current PR version is meant as a starting point as I might have missed something.

The issue seems to be caused because the patterns passed to the integrityChecker only include the root's dependencies. So it never checks if dependencies of workspaces are missing in the lockfile.

I wonder if always setting includeWorkspaceDeps to true in the installation cli command is the right thing to do, especially since those patterns are referred to as topLevelPatterns at a later point, which might indicate that the workspaces dependencies are missing on purpose.

Another idea I had (and that I tried before I found the flag), was to pass all patterns to the integrityChecker, but otherwise leave them as is.

Basically to add:

const dependencies = Array.from(
  this.resolver.getAllDependencyNamesByLevelOrder(patterns)
);

const allPatterns = dependencies.reduce((allPatterns, dependency) => {
  const allInfo = this.resolver.getAllInfoForPackageName(dependency);
  allInfo.forEach(({ _reference: { patterns } }) => {
    for (const pattern of patterns) {
      allPatterns.add(pattern);
    }
  });
  return allPatterns;
}, new Set());

before: https://github.com/yarnpkg/yarn/blob/master/src/cli/commands/install.js#L457 and use allPatterns in place of patterns as argument.

If anybody could point me in the right direction, I'd be happy to continue working on a fix.

Thanks a lot in advance! :)

…ile is used

robin-drexler · 2018-12-11T13:07:38Z

Hey, is there anything that I can do to push things forward? :)

kachkaev · 2019-02-22T13:06:38Z

ping folks 👋 🙏

The current behaviour of the --frozen-lockfile argument does match what the docs are saying. Because of that, CI pipelines for PRs succeed even if somebody updated package.json, but did not update yarn.lock. Inconsistent sets of packages land the master branch and cause a lot of confusion down the line.

nevir · 2019-03-21T16:47:39Z

Same question here: what can we do to help get this in?

kachkaev · 2019-03-21T17:43:39Z

Some workarounds for CI can be found in #5840

arcanis · 2019-09-18T12:45:59Z

Hey, sorry for now pinging back sooner.

The change appears sound, but we're currently working on the v2 (scheduled before the end of the year) and I'm somewhat worried about introducing subtle bugs right before releasing the next major (the way I see it, the current v1 is, despite its shortcomings, relatively stable).

One question in particular I'd need to see answered is why isn't includeWorkspaceDeps always on by default? What does it imply to enable it for every install? I don't remember why it got implemented. Maybe @jgoz would remember (#4654)?

jgoz · 2019-09-18T13:38:46Z

I think I remember why it got implemented in the first place. It’s because running certain commands inside a child workspace needed to consider dependencies across the entire workspace (outdated, upgrade-interactive), mainly because it made more sense from the user’s perspective (maybe? It’s been a long time since I looked at this).

I haven’t fully considered this current change but a safer approach might be to only enable includeWorkspaceDeps when —frozen-lockfile is specified, rather than always enabling it.

I should also note that we long ago switched to using —pure-lockfile in our CI because after reading the docs more carefully, it was the flag we actually wanted.

It looks like the yarn.lock file had gotten out of sync with dependencies, so I updated it. It looks like the `--frozen-lockfile` option, which is specifically designed to prevent this [does not actually work with workspaces][1] and so this may happen from time to time. If we can figure out a cross-platform workaround, then maybe we can apply that at some point. Otherwise, this will remain a bug until we take a shot at yarn v2 [1]: yarnpkg/yarn#6554

This should ensure that we don't run into the kind of issue mentioned here: #233 (comment) Note that `--frozen-lockfile` is supposed to take care of this for us, but it is a known issue that it doesn't work properly in monorepos: yarnpkg/yarn#5840 There is a fix for it: yarnpkg/yarn#6554 But the issue is nearly two years old and the PR is almost as old. Maintainer replies here: yarnpkg/yarn#6554 (comment) that: > The change appears sound, but we're currently working on the v2 > (scheduled before the end of the year) and I'm somewhat worried about > introducing subtle bugs right before releasing the next major (the > way I see it, the current v1 is, despite its shortcomings, relatively > stable)." We face a similar concern in liferay-portal and have a ticket for that: https://issues.liferay.com/browse/LPS-110313

robin-drexler · 2021-03-26T19:47:09Z

👋 I know, it's been a while, but is there any chance that this PR could be merged since it got an approval? :)

Thanks a lot!

NMinhNguyen · 2021-03-26T22:06:30Z

👋 I know, it's been a while, but is there any chance that this PR could be merged since it got an approval? :)

I don't think the approval was from a core maintainer 😕

fix: fail when yarn.lock is updated in workspaces when --frozen-lockf…

fdd858c

…ile is used

erikmueller mentioned this pull request Jul 15, 2019

yarn install --frozen-lockfile is not failing as expected #5840

Closed

waleedahmed3045 approved these changes Sep 20, 2019

View reviewed changes

bxt mentioned this pull request Dec 2, 2019

Workspaces Don't Respect --frozen-lockfile #4098

Closed

chanceaclark mentioned this pull request Mar 25, 2020

fix(ci): yarn install --frozen-lockfile doesn't error bigcommerce/big-design#352

Merged

cowboyd mentioned this pull request Sep 3, 2020

Stabilize yarn.lock file thefrontside/bigtest#500

Merged

wincent mentioned this pull request Nov 16, 2020

feat(monorepo): complain if lockfile is not fresh liferay/liferay-frontend-projects#241

Merged

ohana54 mentioned this pull request Nov 16, 2020

fix: fail when yarn.lock is updated when --frozen-lockfile is used in workspaces VincentBailly/yarn#38

Merged

Dhaulagiri mentioned this pull request Jun 2, 2022

update yarn.lock hashicorp/design-system#335

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix: fail when yarn.lock is updated in workspaces when --frozen-lockfile is used#6554

fix: fail when yarn.lock is updated in workspaces when --frozen-lockfile is used#6554
robin-drexler wants to merge 1 commit intoyarnpkg:masterfrom
robin-drexler:fix-frozen-workspace

robin-drexler commented Oct 18, 2018 •

edited

Loading

Uh oh!

robin-drexler commented Dec 11, 2018

Uh oh!

kachkaev commented Feb 22, 2019 •

edited

Loading

Uh oh!

nevir commented Mar 21, 2019

Uh oh!

kachkaev commented Mar 21, 2019 •

edited

Loading

Uh oh!

arcanis commented Sep 18, 2019

Uh oh!

jgoz commented Sep 18, 2019

Uh oh!

robin-drexler commented Mar 26, 2021 •

edited

Loading

Uh oh!

NMinhNguyen commented Mar 26, 2021 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

Conversation

robin-drexler commented Oct 18, 2018 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

robin-drexler commented Dec 11, 2018

Uh oh!

kachkaev commented Feb 22, 2019 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

nevir commented Mar 21, 2019

Uh oh!

kachkaev commented Mar 21, 2019 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

arcanis commented Sep 18, 2019

Uh oh!

jgoz commented Sep 18, 2019

Uh oh!

robin-drexler commented Mar 26, 2021 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

NMinhNguyen commented Mar 26, 2021 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

robin-drexler commented Oct 18, 2018 •

edited

Loading

kachkaev commented Feb 22, 2019 •

edited

Loading

kachkaev commented Mar 21, 2019 •

edited

Loading

robin-drexler commented Mar 26, 2021 •

edited

Loading

NMinhNguyen commented Mar 26, 2021 •

edited

Loading