Skip to content

feat(cli): warn when embed leaves lockfile versions of a package unembedded [RED-1315] [ship] - #1588

Merged
sorccu merged 1 commit into
mainfrom
simo/red-1315-682525
Oct 29, 2026
Merged

sorccu merged 1 commit into
mainfrom
simo/red-1315-682525

Conversation

@sorccu

@sorccu sorccu commented Oct 29, 2026

Copy link
Copy Markdown
Member

Linear: RED-1315

Summary

Checkly runners answer an embedded package's registry metadata from the code bundle alone, so they list only the embedded versions. Suppose a bundle.packages.embed entry pins one version ('legacy-private-pkg@2.1.0'), or a ! entry excludes one, while the shipped lockfile also uses another version of the same package. npm installs on the runner then fail with ETARGET, and until now the user only found out after a check failed.

checkly test / pw-test / deploy now print a warning at bundle time:

Warning: bundle.packages.embed embeds 'legacy-private-pkg' only at version 2.1.0, but the lockfile also uses 3.0.0. Checkly runners serve an embedded package's versions from the code bundle alone, so installs that resolve package metadata, such as npm's, cannot find the others. Embed every version the lockfile uses: list 'legacy-private-pkg' by name, without a version pin or a '!' exclusion of individual versions.
  • findUnembeddedVersions() (lockfile-filter.ts) compares the embedded set with the lockfile's registry entries. The plan computes it against the full lockfile. When the bundled lockfile was pruned, filterTarballsByLockfile() recomputes it against the pruned one, so versions that only workspace members outside the bundle need do not trigger the warning.
  • It is a warning, not an error. pnpm 11 installs from the lockfile and fetches the tarball directly, so it still succeeds. The warning is not limited to npm lockfiles, because whether other package managers succeed has not been verified.
  • The bundle.packages.embed JSDoc and the configure-playwright-checks AI-context reference now say that a pinned package installs only in its embedded versions.

Test plan

  • Unit tests for findUnembeddedVersions() and the filter's unembedded result
  • Plan tests: a pin reports the versions it leaves out; embedding by name reports none
  • Bundler tests: the warning prints without pruning and with a pruned lockfile that keeps the other version, and stays silent when pruning removed the other version

🤖 Generated with Claude Code

…bedded [RED-1315]

Checkly runners answer an embedded package's registry metadata from the
code bundle alone, listing only the embedded versions. When an embed
entry pins one version (or a '!' entry excludes one) while the shipped
lockfile also uses another version of the same package, npm installs on
the runner fail with ETARGET.

checkly test/deploy now print a warning naming the package, the embedded
versions and the missing ones. The comparison uses the pruned lockfile
when pruning ran, so versions only needed by workspace members outside
the bundle do not warn.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@sorccu sorccu changed the title feat(cli): warn when embed leaves lockfile versions of a package unembedded [RED-1315] feat(cli): warn when embed leaves lockfile versions of a package unembedded [RED-1315] [ship] Oct 29, 2026

@github-actions github-actions Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Auto-approved: ship/show PR from a same-repo branch.

@sorccu
sorccu merged commit e4224c6 into main Oct 29, 2026
16 checks passed
@sorccu
sorccu deleted the simo/red-1315-682525 branch October 29, 2026 12:54
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant