fix: let Renovate link node_modules when updating lockfiles

[cryptodev-2s]

Explanation

Approving an update on the Dependency Dashboard (#10300) produced no pull request. Renovate built the branch, hit a lock file error, and reported No files to commit. Underneath that:

➤ YN0000: ┌ Link step
➤ YN0073: │ Skipped due to mode=update-lockfile
➤ YN0000: └ Completed
Usage Error: Couldn't find the node_modules state file - running an install might help (findPackageLocation)
$ yarn run [--inspect] ... <scriptName>

Renovate runs yarn install --mode=update-lockfile, which skips the Link step, so node_modules and its install state file are never written. Our .yarnrc.yml loads LavaMoat's plugin-allow-scripts, whose afterAllInstalled hook runs yarn run allow-scripts. yarn run needs that state file to resolve the binary, so it exits non zero, and Renovate reads that as a lock file error and throws the updated lockfile away.

Isolated it by running yarn install --mode=update-lockfile cold on main with each piece removed in turn:

.yarnrc.yml plugin	root postinstall	Result
present	present	fails
present	removed	fails
removed	present	exit 0

The third row also shows Yarn does not run root lifecycle scripts in this mode at all, so the root postinstall is not involved.

Setting skipInstalls: false makes Renovate use yarn install --mode=skip-build instead (source): the Link step runs, so the state file exists and allow-scripts succeeds, while dependency build scripts stay skipped. Cold run on main, exit 0 in 26 seconds.

This also reverts #10303. The ! Corepack is about to download line is a notice on stderr, not a blocking prompt, and was never the cause.

References

Reverts #10303. Follows #10298. Part of WPC-1161.

Checklist

• I've updated the test suite for new or updated code as appropriate
• I've updated documentation (JSDoc, Markdown, etc.) for new or updated code as appropriate
• I've communicated my changes to consumers by updating changelogs for packages I've changed
• I've introduced breaking changes in this PR and have prepared draft pull requests for clients and consumer packages to resolve them

[Mrtenz]

Can't we just disable the post-install for Renovate? There's no reason to run it.

Bit hacky, but this is how we do it in the extension:

https://github.com/MetaMask/metamask-extension/blob/4cc1e269a524007ed3f633d0399b48429b91be22/package.json#L41

[Mrtenz]

Where are we doing this yarn run postinstall then? 🤔

[cryptodev-2s]

we're not, yarn is. it's a root lifecycle script so yarn runs it itself after the Link step, that's where the yarn run ... <scriptName> in the error comes from.

and it never gets to the script body anyway. swapped it for a bare node -e "console.log('hi')" and same failure.

[Mrtenz]

So with yarn install --mode=update-lockfile, Yarn still runs postinstall, even though it isn't able to? That seems confusing.

[cryptodev-2s]

nah you were right to doubt it, i had it wrong. yarn doesn't run postinstall in that mode at all.

it's the lavamoat allow-scripts plugin in .yarnrc.yml. its afterAllInstalled hook shells out to yarn run allow-scripts, which needs the node_modules state file update-lockfile never writes. dropping the postinstall changes nothing, dropping the plugin makes it pass.

same fix though, skip-build runs the Link step. PR description updated.

[Mrtenz]

Right, that makes more sense.

Maybe we should add an environment variable to the allow-scripts plugin (or detect the install mode, if that's possible) so we can skip it when it's not needed instead?

I can approve this for now, but maybe look into that as follow-up.

[Gudahtt]

Maybe we should add an environment variable to the allow-scripts plugin (or detect the install mode, if that's possible) so we can skip it when it's not needed instead?

I had the same problem when using Renovate on my Prettier plugin, and this is the same idea I landed on 😄. I forgot to mention it, and haven't implemented it yet. Very easy to do though.