Pin the pnpm version for reproducible web installs #26

New Issue

2026-06-03T21:43:48Z

logaritmisk commented

2026-06-03 21:43:48 +00:00

Context

The web/ package has no packageManager field, and the CI web job pins pnpm only at the major level (pnpm/action-setup@v4 with version: 9). Locally the lockfile was written with pnpm 11.5.1; both emit lockfileVersion: '9.0', so --frozen-lockfile passes today — but the pnpm version is effectively unpinned and can drift between contributors and CI.

What to do

Add a "packageManager": "pnpm@<exact-version>" field to web/package.json (Corepack reads it for a deterministic pnpm).
Make the CI web job's pnpm version consistent with that pin (or rely on Corepack), so local and CI use the same pnpm.

Acceptance

web/package.json declares an exact packageManager pnpm version.
CI uses the same version; pnpm install --frozen-lockfile stays green.

Source: frontend SPA milestone 1 final review — reproducibility nit.

## Context The `web/` package has no `packageManager` field, and the CI `web` job pins pnpm only at the major level (`pnpm/action-setup@v4` with `version: 9`). Locally the lockfile was written with pnpm 11.5.1; both emit `lockfileVersion: '9.0'`, so `--frozen-lockfile` passes today — but the pnpm version is effectively unpinned and can drift between contributors and CI. ## What to do - Add a `"packageManager": "pnpm@<exact-version>"` field to `web/package.json` (Corepack reads it for a deterministic pnpm). - Make the CI `web` job's pnpm version consistent with that pin (or rely on Corepack), so local and CI use the same pnpm. ## Acceptance - `web/package.json` declares an exact `packageManager` pnpm version. - CI uses the same version; `pnpm install --frozen-lockfile` stays green. _Source: frontend SPA milestone 1 final review — reproducibility nit._

logaritmisk closed this issue

2026-06-05 13:54:23 +00:00

logaritmisk referenced this issue from a commit

2026-06-05 14:23:41 +00:00

docs(plans): follow-ups batch (#38 #28 #41 #26)

logaritmisk referenced this issue from a commit

2026-06-05 14:23:41 +00:00

build(web): pin pnpm via packageManager + align CI to pnpm 11 (#26)

logaritmisk referenced this issue from a commit

2026-06-05 14:23:41 +00:00

merge: follow-ups batch (#38 #28 #41 #26)

Sign in to join this conversation.