fix(corp-mirrors): resolve @pnpm from npmjs registry - #120
Merged
Conversation
pnpm 11 asserts an integrity-only resolution for the pinned packageManager (fetched as @pnpm/exe) during self-install. The artifactory npm mirror rewrites the tarball host to its own domain, leaving a tarball field alongside integrity, so the assertion throws and every pnpm invocation in a repo with a packageManager pin fails. Scope only @pnpm to npmjs so the package manager resolves canonically while other installs keep the mirror.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
@pnpmpackage to the npmjs registry so pnpm's package-manager self-install resolves canonically, while every other install keeps flowing through the corp artifactory mirror.Why
pnpm 11 hardened its package-manager self-install: when a repo pins
packageManager(e.g.pnpm@10.23.0), pnpm fetches it as@pnpm/exeand asserts an integrity-only resolution. The artifactory npm mirror rewrites the tarball host to its own domain, so the resolution carries atarballfield alongsideintegrityand the assertion throws. The result is that everypnpminvocation in such a repo fails with:This is not the pnpm version, the pin format, or
manage-package-manager-versions. Each variable was isolated to confirm the sole trigger is the mirror's rewritten tarball host. Pinning the@pnpmscope to npmjs makes the package manager resolve from the canonical registry, where the resolution is integrity-only and the assertion passes.Test plan
nixos-rebuild switch --flake .#wslapplies cleanlypnpm --versionin a repo pinningpackageManagerreturns the pinned version instead of erroringpnpm install,pnpm lint, and a Dockerfilepnpmbuild all run@pnpminstalls still resolve through the artifactory mirror