From 9bf9d29df9b8bf9d1c64a040b0cfccfa369f329b Mon Sep 17 00:00:00 2001 From: iam-truongtrungnghia Date: Thu, 15 Oct 2026 12:05:13 +0700 Subject: [PATCH] ci: install the generated project's node and pnpm up front --- docs/runbook/bump-a-toolchain-version.md | 4 +- mise.lock | 74 ++++++++++++++++++++++++ mise.toml | 5 +- tests/contract.bats | 16 +++++ 4 files changed, 96 insertions(+), 3 deletions(-) diff --git a/docs/runbook/bump-a-toolchain-version.md b/docs/runbook/bump-a-toolchain-version.md index 85a330c..ddf219b 100644 --- a/docs/runbook/bump-a-toolchain-version.md +++ b/docs/runbook/bump-a-toolchain-version.md @@ -8,7 +8,7 @@ When: a pinned tool needs a new version, in the toolbox or in what it generates. | Tool | Pinned in | | --- | --- | - | This toolbox's tools: `bats`, `shellcheck`, `shfmt`, `yq`, `jq`, `zizmor`, `rush`, `lefthook`, `gitleaks` | `mise.toml` | + | This toolbox's tools: `bats`, `shellcheck`, `shfmt`, `yq`, `jq`, `zizmor`, `rush`, `node`, `pnpm`, `lefthook`, `gitleaks` | `mise.toml` | | Every generated project: `node`, `pnpm`, `lefthook`, `gitleaks` | `common/mise.root.toml` | | One adapter's toolchain, e.g. composer for `laravel-api`, node for `laravel-inertia` | `adapters//mise.toml` | | `flask`'s python | `adapters/flask/.python-version` and the `--python` argument in `adapters/flask/adapter.env` | @@ -16,7 +16,7 @@ When: a pinned tool needs a new version, in the toolbox or in what it generates. 2. Edit the version string. Leave the rest of the `[tools]` block alone. -3. `lefthook` and `gitleaks` are pinned twice. Change `mise.toml` and `common/mise.root.toml` together. +3. `node`, `pnpm`, `lefthook` and `gitleaks` are pinned twice. Change `mise.toml` and `common/mise.root.toml` together; `tests/contract.bats` fails when they differ. 4. Re-resolve this toolbox's lock. diff --git a/mise.lock b/mise.lock index 47509a5..009369b 100644 --- a/mise.lock +++ b/mise.lock @@ -166,6 +166,80 @@ url = "https://github.com/evilmartians/lefthook/releases/download/v2.1.11/leftho url_api = "https://api.github.com/repos/evilmartians/lefthook/releases/assets/523446762" provenance = "github-attestations" +[[tools.node]] +version = "24.15.0" +backend = "core:node" +specifiers = ["24.15.0"] + +[tools.node."platforms.linux-arm64"] +checksum = "sha256:73afc234d558c24919875f51c2d1ea002a2ada4ea6f83601a383869fefa64eed" +url = "https://nodejs.org/dist/v24.15.0/node-v24.15.0-linux-arm64.tar.gz" + +[tools.node."platforms.linux-arm64-musl"] +checksum = "sha256:31e98aa960a067da91edffd5d93bc46657b5d2a8029612c359f5f2ac0060152a" +url = "https://unofficial-builds.nodejs.org/download/release/v24.15.0/node-v24.15.0-linux-arm64-musl.tar.gz" + +[tools.node."platforms.linux-x64"] +checksum = "sha256:44836872d9aec49f1e6b52a9a922872db9a2b02d235a616a5681b6a85fec8d89" +url = "https://nodejs.org/dist/v24.15.0/node-v24.15.0-linux-x64.tar.gz" + +[tools.node."platforms.linux-x64-musl"] +checksum = "sha256:f55af5bd489c5347b113ca6594cae00a54b30ba57ac5875324311bfc6f4762e3" +url = "https://unofficial-builds.nodejs.org/download/release/v24.15.0/node-v24.15.0-linux-x64-musl.tar.gz" + +[tools.node."platforms.macos-arm64"] +checksum = "sha256:372331b969779ab5d15b949884fc6eaf88d5afe87bde8ba881d6400b9100ffc4" +url = "https://nodejs.org/dist/v24.15.0/node-v24.15.0-darwin-arm64.tar.gz" + +[tools.node."platforms.macos-x64"] +checksum = "sha256:ffd5ee293467927f3ee731a553eb88fd1f48cf74eebc2d74a6babe4af228673b" +url = "https://nodejs.org/dist/v24.15.0/node-v24.15.0-darwin-x64.tar.gz" + +[tools.node."platforms.windows-x64"] +checksum = "sha256:cc5149eabd53779ce1e7bdc5401643622d0c7e6800ade18928a767e940bb0e62" +url = "https://nodejs.org/dist/v24.15.0/node-v24.15.0-win-x64.zip" + +[[tools.pnpm]] +version = "11.21.0" +backend = "aqua:pnpm/pnpm" +specifiers = ["11.21.0"] + +[tools.pnpm."platforms.linux-arm64"] +checksum = "sha256:64eb219b008f7a4c176d81fbce919c20b0b7e093e815cbb669d46e681451f43b" +url = "https://github.com/pnpm/pnpm/releases/download/v11.21.0/pnpm-linux-arm64.tar.gz" +url_api = "https://api.github.com/repos/pnpm/pnpm/releases/assets/507585528" +provenance = "github-attestations" + +[tools.pnpm."platforms.linux-arm64-musl"] +checksum = "sha256:43587a1f3d26ee009c640378ef377cac3531990579acf0f35646531b7832831d" +url = "https://github.com/pnpm/pnpm/releases/download/v11.21.0/pnpm-linux-arm64-musl.tar.gz" +url_api = "https://api.github.com/repos/pnpm/pnpm/releases/assets/507585511" +provenance = "github-attestations" + +[tools.pnpm."platforms.linux-x64"] +checksum = "sha256:aadc489ce4473c2af0fec06a5c19e113b5793d404eac49853c8153bf4b0d8263" +url = "https://github.com/pnpm/pnpm/releases/download/v11.21.0/pnpm-linux-x64.tar.gz" +url_api = "https://api.github.com/repos/pnpm/pnpm/releases/assets/507585503" +provenance = "github-attestations" + +[tools.pnpm."platforms.linux-x64-musl"] +checksum = "sha256:8cad0a4d20318c0445d992630ace51edc0853fd259573f50ee5d0216dce9b420" +url = "https://github.com/pnpm/pnpm/releases/download/v11.21.0/pnpm-linux-x64-musl.tar.gz" +url_api = "https://api.github.com/repos/pnpm/pnpm/releases/assets/507585524" +provenance = "github-attestations" + +[tools.pnpm."platforms.macos-arm64"] +checksum = "sha256:860a96978a79ca5132bdc247375f94150a3c98edbecbee36e9f8e0c9e2f7f056" +url = "https://github.com/pnpm/pnpm/releases/download/v11.21.0/pnpm-darwin-arm64.tar.gz" +url_api = "https://api.github.com/repos/pnpm/pnpm/releases/assets/507585526" +provenance = "github-attestations" + +[tools.pnpm."platforms.windows-x64"] +checksum = "sha256:6643043caa3b01c65c431039926a2af954326d5cefbdb4da7baceceb17f5051f" +url = "https://github.com/pnpm/pnpm/releases/download/v11.21.0/pnpm-win32-x64.zip" +url_api = "https://api.github.com/repos/pnpm/pnpm/releases/assets/507585516" +provenance = "github-attestations" + [[tools.shellcheck]] version = "0.11.0" backend = "aqua:koalaman/shellcheck" diff --git a/mise.toml b/mise.toml index 19967e4..9a58ed4 100644 --- a/mise.toml +++ b/mise.toml @@ -6,7 +6,10 @@ yq = "4.48.1" jq = "1.8.1" zizmor = "1.29.0" "ubi:shenwei356/rush" = "0.9.0" -# The same versions common/mise.root.toml pins into generated projects. +# The same versions common/mise.root.toml pins into generated projects, so CI +# installs them up front instead of each parallel test racing to install them. +node = "24.15.0" +pnpm = "11.21.0" lefthook = "2.1.11" gitleaks = "8.30.0" diff --git a/tests/contract.bats b/tests/contract.bats index 73d8b79..3e33e95 100644 --- a/tests/contract.bats +++ b/tests/contract.bats @@ -294,3 +294,19 @@ setup() { false } } + +@test "the toolbox pins every tool a generated project pins, at the same version" { + # Unpinned here, a project tool installs lazily inside each test; the unit + # lane's parallel jobs then race those installs, and mise 2026.9.11+ fails + # the losers with `"pnpm" couldn't exec process`. + local tool want got missing="" + while IFS= read -r tool; do + want="$(yq -p toml -oy ".tools.\"${tool}\"" "${SCAFFOLD_ROOT}/common/mise.root.toml")" + got="$(yq -p toml -oy ".tools.\"${tool}\"" "${SCAFFOLD_ROOT}/mise.toml")" + [ "$got" = "$want" ] || missing="${missing}${tool}: toolbox ${got}, project ${want}"$'\n' + done < <(yq -p toml -oy '.tools | keys | .[]' "${SCAFFOLD_ROOT}/common/mise.root.toml") + [ -z "$missing" ] || { + printf '%s' "$missing" + false + } +}