From 52e7f8b10e074999305ca302c45f6be31e800763 Mon Sep 17 00:00:00 2001 From: Evan Vetere Date: Sat, 12 Sep 2026 13:40:06 -0400 Subject: [PATCH] fix: Let the weekly bump write its own lockfile The scheduled Backstage bump has failed all ten runs since 6 July. Yarn turns on enableImmutableInstalls whenever CI is set, and versions:bump runs its own yarn install to resolve the new versions. That install exists to rewrite the lockfile, so Yarn refuses it and the job dies before it can open a pull request. The peer-dependency warnings in the log are not the cause. The same six warnings appear in the immutable install one step earlier, which exits zero, and the bump succeeds with them still present once immutable mode is off. Key changes: - Scope immutable installs off to the bump step alone, which is the one step whose job is to rewrite the lockfile - Add a verification install after the bump so an inconsistent lockfile fails the job rather than reaching a pull request - Reuse the shared setup action so the checked-in lockfile is verified by the same command in every workflow Neither install is relaxed. The lockfile is checked immutably before the bump and again after it. Claude-Session: https://claude.ai/code/session_01QV419URMnKWckY8s6j4Dwi --- .github/workflows/version-bump.yaml | 17 +++++++---------- 1 file changed, 7 insertions(+), 10 deletions(-) diff --git a/.github/workflows/version-bump.yaml b/.github/workflows/version-bump.yaml index d92a92a..cb3fa51 100644 --- a/.github/workflows/version-bump.yaml +++ b/.github/workflows/version-bump.yaml @@ -16,20 +16,17 @@ jobs: - name: Checkout uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - - name: Set up Node.js - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 - with: - node-version: 22 - - - name: Enable Corepack - run: corepack enable - - - name: Install dependencies - run: yarn install --immutable + - name: Setup Node and Yarn + uses: ./.github/actions/setup-node-yarn - name: Bump Backstage packages + env: + YARN_ENABLE_IMMUTABLE_INSTALLS: 'false' run: yarn backstage-cli versions:bump + - name: Verify the bumped lockfile + run: yarn install --immutable + - name: Open pull request uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1 with: