devantler-tech / devantler-tech/ksail

fix(docs): dependency bumps drop platform-specific optional deps from the lock file, breaking npm ci

Open
#6,800 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
165
Forks
12
Avg merge
5h 41m
Merged PRs (30d)
337

Description

> 🤖 Generated by the Agentic Engineer

### Motivation

Every dependency bump that touches `docs/` currently fails CI, and it fails the same way each time —
so this blocks the docs dependency queue rather than any one update.

`📚 Build Documentation` fails at `npm ci`:

```
npm error `npm ci` can only install packages when your package.json and package-lock.json
npm error Missing: @bruits/satteri-darwin-arm64@ from lock file
npm error Missing: @bruits/satteri-linux-x64-musl@ from lock file
```

**Evidence that the bump introduces it, rather than it being pre-existing.** `docs/package-lock.json`
on `main` contains both entries (5 occurrences each) and `main` is green. The regenerated lock file on
the bump branches does not.

This is npm's long-standing optional-dependency pruning behaviour: `npm install` run on one platform
writes a lock file describing **only that platform's** optional binaries, dropping the sibling
platform entries. `npm ci` then refuses on any other platform because the lock no longer matches
`package.json`.

### Impact

Affects every `docs/` dependency update, not a single PR — currently #6794 (mermaid 11.17.0→11.17.1)
and #6791 (astro group), both `BLOCKED` with `🔍 Audit Docs Dependencies`, `📚 Build Documentation`
and `CI - Required Checks` failing. It will recur on the next one regardless of what those two do.

### Expected behaviour

`docs/package-lock.json` keeps the optional binaries for **every** platform CI and contributors build
on, so `npm ci` succeeds on linux-x64, linux-x64-musl and darwin-arm64 alike.

### Acceptance criteria

- [ ] A docs dependency bump lands with `npm ci` green on CI's platform.
- [ ] The lock file still resolves for darwin-arm64 (local development) after that bump.
- [ ] The property is **enforced**, not restored by hand — otherwise the next bump reintroduces it.
Candidates: a lock-file integrity check in `🔍 Audit Docs Dependencies` that fails when a
platform's optional entry disappears, or regenerating the lock across the supported platform
set as part of the update.

### Note on the remedy

Regenerating the lock file on a single machine is what *causes* this, so a naive local `npm install`
would drop the linux entries instead of the darwin one — the same bug pointed the other way. Whoever
takes this should verify the result on more than the platform they regenerate it on; a green CI run
alone does not prove the darwin side survived.

Size: small-to-medium. Root-cause fix, not a per-PR unblock.

Contributor guide

Open the contributing guide

Research direction

Start with docs/package-lock.json and the failing 📚 Build Documentation npm ci job; compare main with a regenerated dependency-bump lock file to confirm which optional platform entries disappear. Then inspect 🔍 Audit Docs Dependencies and choose an enforcement approach from the issue's candidates. Done means dependency bumps retain linux-x64, linux-x64-musl, and darwin-arm64 entries, with npm ci succeeding for the supported platforms.

Written by the indexing model from the issue text.

Assessment

Tech stack
node.js
Domain
build-system, ci-cd
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
52/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.