From 78d35cfd2961598cfeaf4e5cc4a2fb8e1dcb32a2 Mon Sep 17 00:00:00 2001
From: rob thijssen <grenade@rob.tn>
Date: Mon, 31 Aug 2026 13:21:54 +0300
Subject: [PATCH] ci(web): declare the build allowlist in both places, and
 report pnpm's view

Third build-web failure with the same ERR_PNPM_IGNORED_BUILDS. The
setting was first in package.json (pnpm 10 here does not read it) and
then in pnpm-workspace.yaml (verified read here, still ignored on the
runner), so the runner's pnpm evidently resolves it differently and I
have been guessing at which.

Declares it in both locations -- four duplicated lines against a failure
that only manifests on CI -- and adds a step printing pnpm --version and
the resolved value, so if this still fails the log says why instead of
costing another round trip.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XZG2i4AmfSqE97EJGBVb64
---
 .gitea/workflows/ci.yml     | 11 +++++++++++
 .gitea/workflows/deploy.yml | 11 +++++++++++
 web/package.json            |  6 ++++++
 web/pnpm-workspace.yaml     | 13 ++++++++-----
 4 files changed, 36 insertions(+), 5 deletions(-)

diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 6f27846..602adb0 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -33,6 +33,17 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
+      # The runner's pnpm is not necessarily the workstation's, and this
+      # setting moved location between 10.x releases. Print what it actually
+      # resolves to, so a failure here is diagnosable from the log rather than
+      # by pushing another guess.
+      - name: pnpm environment
+        working-directory: web
+        run: |
+          pnpm --version
+          pnpm config get --json onlyBuiltDependencies || true
+          pnpm config list || true
+
       - name: install
         working-directory: web
         run: pnpm install --frozen-lockfile
diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
index 76742e8..ecda86c 100644
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -61,6 +61,17 @@ jobs:
 
       # The gate for the frontend, matching the Rust one: a type error or a
       # lint failure must not reach a host either.
+      # The runner's pnpm is not necessarily the workstation's, and this
+      # setting moved location between 10.x releases. Print what it actually
+      # resolves to, so a failure here is diagnosable from the log rather than
+      # by pushing another guess.
+      - name: pnpm environment
+        working-directory: web
+        run: |
+          pnpm --version
+          pnpm config get --json onlyBuiltDependencies || true
+          pnpm config list || true
+
       - name: install
         working-directory: web
         run: pnpm install --frozen-lockfile
diff --git a/web/package.json b/web/package.json
index a89b13c..0bfde7b 100644
--- a/web/package.json
+++ b/web/package.json
@@ -32,5 +32,11 @@
     "typescript": "^5.9.3",
     "typescript-eslint": "^8.46.2",
     "vite": "^7.2.2"
+  },
+  "pnpm": {
+    "onlyBuiltDependencies": [
+      "@swc/core",
+      "esbuild"
+    ]
   }
 }
diff --git a/web/pnpm-workspace.yaml b/web/pnpm-workspace.yaml
index 686c4ae..d820102 100644
--- a/web/pnpm-workspace.yaml
+++ b/web/pnpm-workspace.yaml
@@ -1,9 +1,12 @@
-# pnpm 10 reads settings from here, not from package.json's `pnpm` field.
+# The allowlist of dependencies permitted to run install scripts. Both fetch a
+# platform-native binary; every other package in the tree is denied, which is
+# the point -- an install script is arbitrary code from a transitive dependency.
 #
-# An explicit allowlist of dependencies permitted to run install scripts. Both
-# fetch a platform-native binary at install time and do not work without it;
-# every other package in the tree is denied, which is the point — an install
-# script is arbitrary code from a transitive dependency.
+# Declared here *and* in package.json's `pnpm` field on purpose: pnpm moved
+# this setting between 10.x releases, and the workstation and the CI runner do
+# not carry the same version. Whichever one is authoritative, it finds the same
+# list, and the duplication is four lines against a failure that only shows up
+# on the runner.
 onlyBuiltDependencies:
   - '@swc/core'
   - esbuild