devantler-tech / devantler-tech/ksail
fix(docs): dependency bumps drop platform-specific optional deps from the lock file, breaking npm ci
- Dominant language
- Go
- Stars
- 165
- Forks
- 12
- Avg merge
- 5h 41m
- Merged PRs (30d)
- 337
Description
> 🤖 Generated by the Agentic Engineer
### Motivation
Every dependency bump that touches `docs/` currently fails CI, and it fails the same way each time —
so this blocks the docs dependency queue rather than any one update.
`📚 Build Documentation` fails at `npm ci`:
```
npm error `npm ci` can only install packages when your package.json and package-lock.json
npm error Missing: @bruits/satteri-darwin-arm64@ from lock file
npm error Missing: @bruits/satteri-linux-x64-musl@ from lock file
```
**Evidence that the bump introduces it, rather than it being pre-existing.** `docs/package-lock.json`
on `main` contains both entries (5 occurrences each) and `main` is green. The regenerated lock file on
the bump branches does not.
This is npm's long-standing optional-dependency pruning behaviour: `npm install` run on one platform
writes a lock file describing **only that platform's** optional binaries, dropping the sibling
platform entries. `npm ci` then refuses on any other platform because the lock no longer matches
`package.json`.
### Impact
Affects every `docs/` dependency update, not a single PR — currently #6794 (mermaid 11.17.0→11.17.1)
and #6791 (astro group), both `BLOCKED` with `🔍 Audit Docs Dependencies`, `📚 Build Documentation`
and `CI - Required Checks` failing. It will recur on the next one regardless of what those two do.
### Expected behaviour
`docs/package-lock.json` keeps the optional binaries for **every** platform CI and contributors build
on, so `npm ci` succeeds on linux-x64, linux-x64-musl and darwin-arm64 alike.
### Acceptance criteria
- [ ] A docs dependency bump lands with `npm ci` green on CI's platform.
- [ ] The lock file still resolves for darwin-arm64 (local development) after that bump.
- [ ] The property is **enforced**, not restored by hand — otherwise the next bump reintroduces it.
Candidates: a lock-file integrity check in `🔍 Audit Docs Dependencies` that fails when a
platform's optional entry disappears, or regenerating the lock across the supported platform
set as part of the update.
### Note on the remedy
Regenerating the lock file on a single machine is what *causes* this, so a naive local `npm install`
would drop the linux entries instead of the darwin one — the same bug pointed the other way. Whoever
takes this should verify the result on more than the platform they regenerate it on; a green CI run
alone does not prove the darwin side survived.
Size: small-to-medium. Root-cause fix, not a per-PR unblock.
Contributor guide
Research direction
Start with docs/package-lock.json and the failing 📚 Build Documentation npm ci job; compare main with a regenerated dependency-bump lock file to confirm which optional platform entries disappear. Then inspect 🔍 Audit Docs Dependencies and choose an enforcement approach from the issue's candidates. Done means dependency bumps retain linux-x64, linux-x64-musl, and darwin-arm64 entries, with npm ci succeeding for the supported platforms.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- node.js
- Domain
- build-system, ci-cd
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 52/100