This repository was archived by the owner on Aug 5, 2026. It is now read-only.
fix: pnpm pinnen — der 11.11-Bump hat den Produktions-Build zerlegt - #5
Merged
Conversation
My own chore commit caused this. Bumping packageManager to 11.11.0 changed the allowBuilds matcher: 11.11 wants a package's FULL specifier (tarball URL plus commit hash) where 11.5 accepted its name, so the `tessera-sdk: true` entry in pnpm-workspace.yaml stopped matching and `pnpm install --frozen-lockfile` died inside the Docker build. Coolify's log masked the commit hash as <REDACTED>, which made it look like a leaked secret — it is not, just a long hex string. Writing the full specifier into allowBuilds would "fix" it until the next SDK version, when the hash changes and it breaks again. Reverting to 11.5.2 is the honest move: the bump bought nothing and cost a working deploy. The Dockerfile also asked for `pnpm@11`, a floating major that silently picks up whatever 11.x is newest at build time — the same failure was going to arrive on its own eventually. Both are pinned to 11.5.2 now and annotated to stay in lockstep. Verified by building the image locally, not by hoping. Note for later: CI stayed green through all of this because `pnpm test` does not build the image. The deploy IS the image build, so a green check was misleading. Adding a docker build step to CI would have caught it pre-merge. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01SU6PBvGFbeHyKhBgnAnz1H
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Der Deploy von PR #4 ist fehlgeschlagen, und mein eigener Commit war schuld.
Der Bump von
packageManagerauf pnpm 11.11.0 hat denallowBuilds-Matcher verschärft: 11.11 will den vollen Spezifizierer eines Pakets (Tarball-URL plus Commit-Hash), wo 11.5 den Paketnamen akzeptierte. Damit greift der Eintragtessera-sdk: trueinpnpm-workspace.yamlnicht mehr undpnpm install --frozen-lockfilestirbt im Docker-Build.(Coolifys Log maskierte den Commit-Hash als
<REDACTED>, was wie ein geleaktes Secret aussah. Ist keins — nur eine lange Hex-Zeichenkette.)Den vollen Spezifizierer in die Allowlist zu schreiben würde bis zum nächsten SDK-Update halten, dann ändert sich der Hash und es bricht erneut. Zurück auf 11.5.2 ist der ehrliche Weg: Der Bump hat nichts gebracht und einen funktionierenden Deploy gekostet.
Zusätzlich stand im Dockerfile
pnpm@11— ein gleitender Major, der beim Bauen einfach das neueste 11.x zieht. Derselbe Fehler wäre also irgendwann von allein gekommen. Beide Stellen sind jetzt auf 11.5.2 gepinnt und kommentiert.Verifiziert durch einen lokalen
docker build, nicht durch Hoffnung.Lehre für später
Die CI blieb die ganze Zeit grün, weil
pnpm testdas Image nicht baut. Der Deploy ist aber der Image-Build — ein grüner Haken war hier irreführend. Eindocker build-Schritt in der CI hätte das vor dem Merge gefangen. Das braucht eine Änderung an.github/workflows/, die mit dem aktuellen Token nicht pushbar ist; sag Bescheid, dann mache ich es separat.🤖 Generated with Claude Code
https://claude.ai/code/session_01SU6PBvGFbeHyKhBgnAnz1H