From fa16f88d6b003db75206f5b75123aa50f13ecb65 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Thu, 3 Sep 2026 11:08:34 -0500
Subject: [PATCH] chore(lockfile): refresh pnpm-lock.yaml (#12771)

Use full dependency resolution in automated lockfile repair paths, add regression coverage, and refresh the stale Rollup snapshot.

Co-Authored-By: Dotta <cryppadotta@users.noreply.github.com>
Co-Authored-By: Codex <codex@openai.com>
Co-Authored-By: lockfile-bot <lockfile-bot@users.noreply.github.com>
---
 .../tests/lockfile-refresh-workflows.test.mjs | 24 +++++++++++++++++++
 .github/workflows/docker.yml                  |  4 ++--
 .github/workflows/pr-trusted.yml              |  2 +-
 .github/workflows/refresh-lockfile.yml        |  2 +-
 pnpm-lock.yaml                                |  3 +--
 scripts/__tests__/e2e-shard.test.mjs          |  4 ++--
 6 files changed, 31 insertions(+), 8 deletions(-)
 create mode 100644 .github/scripts/tests/lockfile-refresh-workflows.test.mjs

diff --git a/.github/scripts/tests/lockfile-refresh-workflows.test.mjs b/.github/scripts/tests/lockfile-refresh-workflows.test.mjs
new file mode 100644
index 0000000000..52fef1f698
--- /dev/null
+++ b/.github/scripts/tests/lockfile-refresh-workflows.test.mjs
@@ -0,0 +1,24 @@
+import { readFile } from 'node:fs/promises';
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+
+const workflows = [
+  '.github/workflows/refresh-lockfile.yml',
+  '.github/workflows/pr-trusted.yml',
+  '.github/workflows/docker.yml',
+];
+
+test('lockfile repair workflows resolve dependencies instead of updating metadata only', async () => {
+  for (const workflow of workflows) {
+    const contents = await readFile(workflow, 'utf8');
+    const repairCommands = contents
+      .split('\n')
+      .filter((line) => line.includes('pnpm install') && line.includes('--no-frozen-lockfile'));
+
+    assert.ok(repairCommands.length > 0, `${workflow} must contain a lockfile repair command`);
+    for (const command of repairCommands) {
+      assert.match(command, /--ignore-scripts/);
+      assert.doesNotMatch(command, /--lockfile-only/);
+    }
+  }
+});
diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index 14b8937abe..5fb9f7e600 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -87,7 +87,7 @@ jobs:
       - name: Refresh lockfile for Docker build context
         run: |
           set -euo pipefail
-          pnpm install --lockfile-only --ignore-scripts --no-frozen-lockfile
+          pnpm install --ignore-scripts --no-frozen-lockfile
 
           changed="$(git status --porcelain)"
           if [ -z "$changed" ]; then
@@ -281,7 +281,7 @@ jobs:
       - name: Refresh lockfile for Docker build context
         run: |
           set -euo pipefail
-          pnpm install --lockfile-only --ignore-scripts --no-frozen-lockfile
+          pnpm install --ignore-scripts --no-frozen-lockfile
 
           changed="$(git status --porcelain)"
           if [ -z "$changed" ]; then
diff --git a/.github/workflows/pr-trusted.yml b/.github/workflows/pr-trusted.yml
index 5bc040f992..7bd403aa57 100644
--- a/.github/workflows/pr-trusted.yml
+++ b/.github/workflows/pr-trusted.yml
@@ -337,7 +337,7 @@ jobs:
         id: regen_lockfile
         run: |
           cp pnpm-lock.yaml "$RUNNER_TEMP/pnpm-lock.before.yaml"
-          pnpm install --lockfile-only --ignore-scripts --no-frozen-lockfile
+          pnpm install --ignore-scripts --no-frozen-lockfile
           if cmp -s "$RUNNER_TEMP/pnpm-lock.before.yaml" pnpm-lock.yaml; then
             echo "regenerated=0" >> "$GITHUB_OUTPUT"
           else
diff --git a/.github/workflows/refresh-lockfile.yml b/.github/workflows/refresh-lockfile.yml
index 49ac2176e7..039d21970e 100644
--- a/.github/workflows/refresh-lockfile.yml
+++ b/.github/workflows/refresh-lockfile.yml
@@ -35,7 +35,7 @@ jobs:
           cache: pnpm
 
       - name: Refresh pnpm lockfile
-        run: pnpm install --lockfile-only --ignore-scripts --no-frozen-lockfile
+        run: pnpm install --ignore-scripts --no-frozen-lockfile
 
       - name: Fail on unexpected file changes
         run: |
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 4c48d3cf96..4d2ab65103 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -7210,7 +7210,6 @@ packages:
 
   opencode-ai@1.18.17:
     resolution: {integrity: sha512-Pc2D3Y6iQ3BAjcKw9E+9J7VTWNazIwFknFfrolufMCrJ0FLxOIZfndoHmJrx4x1oqpK2CPAqK9D2V6nsp6Oebw==}
-    cpu: [arm64, x64]
     os: [darwin, linux, win32]
     hasBin: true
 
@@ -16024,7 +16023,7 @@ snapshots:
       fdir: 6.5.0(picomatch@4.0.7)
       picomatch: 4.0.7
       postcss: 8.5.26
-      rollup: 4.62.4
+      rollup: 4.63.1
       tinyglobby: 0.2.17
     optionalDependencies:
       '@types/node': 24.13.3
diff --git a/scripts/__tests__/e2e-shard.test.mjs b/scripts/__tests__/e2e-shard.test.mjs
index e1074ea683..691c0b6cc1 100644
--- a/scripts/__tests__/e2e-shard.test.mjs
+++ b/scripts/__tests__/e2e-shard.test.mjs
@@ -306,8 +306,8 @@ test("the trusted PR workflow regenerates stale stacked lockfiles", () => {
   );
   assert.match(
     workflow,
-    /pnpm install --lockfile-only --ignore-scripts --no-frozen-lockfile/,
-    "the policy job must validate the complete merge tree instead of only the current PR layer",
+    /pnpm install --ignore-scripts --no-frozen-lockfile/,
+    "the policy job must resolve the complete merge tree instead of only updating lockfile metadata",
   );
   assert.match(
     workflow,