Skip to content

feat(node): exclude own org packages from pnpm release cooldown#54

Merged
fastner merged 1 commit into
mainfrom
feat/pnpm-minimum-release-age-exclude-v2
Jun 22, 2026
Merged

feat(node): exclude own org packages from pnpm release cooldown#54
fastner merged 1 commit into
mainfrom
feat/pnpm-minimum-release-age-exclude-v2

Conversation

@fastner

@fastner fastner commented Jun 22, 2026

Copy link
Copy Markdown
Member

Re-lands PR #52. That PR was stacked on #50 (fix/oxfmt-ignore-patterns) and got merged into the stale oxfmt branch at 18:02 — ten minutes after #50 had already merged to main (17:52). It was never retargeted, so GitHub marks #52 MERGED but the change never reached main (still v5). This PR brings the identical, already-reviewed commit onto a fresh branch off current main.

Requirement

The org's own npm packages must load directly, without pnpm's minimum release age cooldown — for every @sebastian-gmbh/* and @sebastian-software/* package. Added to the node standard and the changelog.

Problem

pnpm 11 enables supply-chain protection by default: minimumReleaseAge defaults to 1440 minutes (24h), so a freshly published version is not resolved until it is a day old (pnpm 11 notes). Good for third-party deps, but it also makes a just-released @sebastian-software/* / @sebastian-gmbh/* version invisible to consumers for 24h, blocking fast internal iteration and back-to-back releases.

Fix

pnpm's minimumReleaseAgeExclude accepts name patterns (pnpm 10.17 notes). Exempt only the two org scopes; every third-party dependency keeps the secure default.

minimumReleaseAgeExclude:
  - "@sebastian-gmbh/*"
  - "@sebastian-software/*"

Changes

  • reference/node/pnpm-workspace.yaml + repo pnpm-workspace.yaml: add the minimumReleaseAgeExclude block.
  • changes/0006-pnpm-minimum-release-age-exclude.md: new changelog (node scope, standards v6) with a judgement step. pnpm-workspace.yaml is a reference file only — not managed/seeded (its allowBuilds list is repo-specific) — so standards apply does not write it; propagation to existing repos is the judgement step, per the SKILL.md config-merge rule.
  • manifest.json currentVersion 5 → 6, .repometa.json stamp 5 → 6, test/standards.test.ts selectChanges expectations extended to 6.
  • docs/plan/0015-pnpm-minimum-release-age-exclude.md: completion doc.

Verification

pnpm agent:check green — lint, format:check, typecheck, build, 75 tests, and standards check self-check (repo matches its own standards at v6).

🤖 Generated with Claude Code

pnpm 11 defaults minimumReleaseAge to 1440 minutes, so a freshly
published version is not resolved until it is a day old. That cooldown
also stalls the org's own packages, blocking fast internal iteration.

Add a minimumReleaseAgeExclude block with the @sebastian-gmbh/* and
@sebastian-software/* scope globs to the reference and repo
pnpm-workspace.yaml so internal releases install immediately while
third-party deps keep the secure default. Ship change 0006 (standards
version 6) with a judgement step, since pnpm-workspace.yaml is a
reference file that apply does not write.
@fastner
fastner merged commit 48e9e24 into main Jun 22, 2026
1 check passed
@fastner
fastner deleted the feat/pnpm-minimum-release-age-exclude-v2 branch June 22, 2026 20:19
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant