Repository navigation
Hotfix 0.2.1: a clean checkout of 0.2.0 cannot install - #18
Merged
Merged
Conversation
Bumping the five version fields to 0.2.0 left apps/web asking for @redrob/harness@0.1.0 and harness asking for @redrob/tokenizers@0.1.0, so yarn stopped resolving them from the workspace and looked on npm, where these private packages do not exist. Every CI job that runs yarn install --frozen-lockfile failed on main, and a fresh clone of v0.2.0 could not install at all. A local install did not notice, because node_modules was already linked. Nothing here is published, so an exact internal pin only creates a second place to remember on every bump. A star range resolves to the workspace regardless of version, so the next bump cannot reintroduce this. Co-authored-by: Janghoon Lee <savagemanage@users.noreply.github.com>
The five-file list was accurate and still let 0.2.0 ship a broken install, because the internal dependency ranges were a sixth place nobody names. They no longer need bumping, so the list is now complete on purpose rather than by accident, and the release checklist gains the frozen-lockfile install that sees a bump the way CI does. Co-authored-by: Janghoon Lee <savagemanage@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Hotfix off
main, as the branching model requires for a defect that is already in production. Merge with a merge commit, never squash, then tagv0.2.1and merge back intodevelop.What broke
The 0.2.0 bump moved all four packages to
0.2.0and left the internal ranges behind:apps/webasked for@redrob/harness@0.1.0@redrob/harnessasked for@redrob/tokenizers@0.1.0Neither version exists any more, so yarn stopped resolving them from the workspace and went looking for private packages on the npm registry:
Every CI job that runs
yarn install --frozen-lockfilefailed onmainand ondevelop:verify,TypeScript conformance,Zero divergence,Quickstart without Python. A clean clone ofv0.2.0could not install at all.Why the release QA missed it. Local
yarn typecheck,lint,test,build, all tenverify:*scripts and a production-build click-through all passed, becausenode_moduleswas already linked from before the bump. Resolution is the one step a warm working tree never repeats, so nothing local could see it.The fix
The workspaces now depend on each other by
"*". Every package here isprivate: true, nothing publishes, andyarn.lockholds no@redrob/*entries, so an exact internal pin bought nothing and cost a second place to remember on every bump. A star range resolves to the workspace whatever the version, which retires this failure mode rather than repairing this instance of it.Patch version bumped to
0.2.1across the same five files.CONTRIBUTING.mdnow states why the workspaces are not pinned, and adds the check that would have caught this: runyarn install --frozen-lockfileon the release branch in a clean checkout, not in your working tree.Verification
Reproduced and fixed in throwaway worktrees, not in the warm tree:
yarn install --frozen-lockfilev0.2.0[2/5] Resolving packageswith the error abovehotfix/0.2.1Plus
yarn typecheck,yarn lint,yarn build, andyarn testat 985/985 on this branch.