ci: install pnpm v12 and configure the bundle with native pnpm commands by zkochan · Pull Request #10627 · teambit/bit

zkochan · 2026-08-18T12:50:54Z

Updates the CircleCI bundle jobs to pnpm v12 and drops the pnpm dlx workarounds that populated pnpm.overrides in package.json.

Why the workarounds had to go

pnpm 12 no longer reads the pnpm field in package.json — it says so outright:

[WARN] The "pnpm" field in package.json is no longer read by pnpm. The following keys were ignored: "pnpm.overrides", "pnpm.neverBuiltDependencies".

So the ten pnpm dlx @ialdama/jsonmod / pnpm dlx json calls would have produced a bundle with no overrides at all. They are replaced by one native command:

pnpm config set --location=project --json overrides '{ ... }'

The .npmrc echoes are dead in v12 for the same reason: node-linker, package-import-method, user-agent and prefer-symlinked-executables are not read from there any more (verified: a hoisted request in .npmrc silently produced an isolated tree, and the custom user-agent never reached the registry). pnpm config set routes each setting to its own home — pnpm settings to pnpm-workspace.yaml, registry to .npmrc.

Two consequences of the version bump

pnpm is no longer installed from npm. v12 is a native binary that the pnpm package only fetches from a preinstall script, which newer npm blocks by default — leaving a placeholder bin that dies with a shell syntax error. npx get-pnpm is pnpm's own installer. It hands off to pnpm setup, which writes the PATH entry to ~/.bashrc (a file CircleCI steps never read), so PNPM_HOME also goes on $BASH_ENV; SHELL is set because the installer exits non-zero with ERR_PNPM_UNKNOWN_SHELL without it.
strictDepBuilds is turned off. Dependency build scripts have never run for the bundle, and v12 fails an install that skips one (ERR_PNPM_IGNORED_BUILDS) where v10 only warned. Without this, pnpm add @teambit/bit errors and never writes the dependency to package.json.

Deduplication

install_bit_bundle_windows was a copy of install_bit_bundle apart from --os=win32 and one setting, and its neverBuiltDependencies workaround has no meaning in v12, where dependency scripts are opt-in. It is merged into install_bit_bundle behind a prefer_symlinked_executables parameter.

Verification

The install command was rendered out of the YAML with its parameters substituted and run for real against node-registry.bit.cloud, for both linux/x64 and win32/x64:

exits 0, installs 3673 packages in a hoisted tree
every override applied (lodash 4.17.21, uri-js → uri-js-replace, harmony 0.4.12)
the platform's pnpm-napi.node is present, which is what verify_pnpm_napi_bundle checks (napi.linux-x64 / napi.win32-x64)
pnpm-lock.yaml is still lockfileVersion: '9.0', the format the bvm upload step consumes

🤖 Generated with Claude Code

pnpm 12 no longer reads its settings from the "pnpm" field in package.json ("The 'pnpm' field in package.json is no longer read by pnpm"), so the jsonmod and json dlx calls that populated pnpm.overrides would have produced a bundle with no overrides at all. They are replaced by a single native `pnpm config set --location=project --json overrides '{...}'`, which writes pnpm-workspace.yaml. The same applies to the .npmrc echoes: in v12 node-linker, package-import-method, user-agent and prefer-symlinked-executables are not read from there (a hoisted request in .npmrc silently produced an isolated tree, and the custom user-agent never reached the registry). `pnpm config set` routes each one to its home - pnpm settings to pnpm-workspace.yaml, registry to .npmrc. Two consequences of the version bump: - pnpm is no longer installed from npm. It is a native binary that the `pnpm` package only fetches from a preinstall script, which newer npm blocks by default, leaving a placeholder bin behind. `npx get-pnpm` is pnpm's own installer. It hands off to `pnpm setup`, which writes the PATH entry to ~/.bashrc - a file CircleCI steps never read - so PNPM_HOME is also put on $BASH_ENV, and SHELL is set because the installer errors without it. - `strictDepBuilds` is turned off. Dependency build scripts have never run for the bundle, and v12 fails an install that skips one where v10 only warned. install_bit_bundle_windows was a copy of install_bit_bundle apart from --os=win32 and one setting, and its neverBuiltDependencies workaround has no meaning in v12, where dependency scripts are opt-in. It is merged into install_bit_bundle behind a prefer_symlinked_executables parameter. Both platforms were verified end to end against node-registry.bit.cloud: the install exits 0, the tree is hoisted, every override is applied, the platform's pnpm-napi.node is present for verify_pnpm_napi_bundle, and pnpm-lock.yaml is still lockfileVersion 9.0 for the bvm upload. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

qodo-free-for-open-source-projects · 2026-08-18T12:52:05Z

PR Summary by Qodo

ci: migrate CircleCI bundle jobs to pnpm v12 with native config commands

⚙️ Configuration changes 🕐 20-40 Minutes

AI Description

• Install pnpm v12 via pnpm’s native installer and export PNPM_HOME for CircleCI steps.
• Replace .npmrc echoes and pnpm dlx JSON patching with pnpm config set (including JSON
 overrides).
• Consolidate Windows bundle install into the shared command via a symlink-executable toggle.

Diagram

graph TD
  J["bundle_version_* jobs"] --> S["setup_pnpm"] --> I["install_bit_bundle"] --> P[/"Project pnpm config"/] --> R[("node-registry.bit.cloud")] --> A["pnpm add @teambit/bit"] --> V["verify_pnpm_napi_bundle"]
  subgraph Legend
    direction LR
    _job["Job/Command"] ~~~ _cfg[/"Config"/] ~~~ _reg[("Registry")]
  end

High-Level Assessment

The following are alternative approaches to this PR:

1. Use Corepack to provision pnpm

➕ Potentially simpler than get-pnpm + PNPM_HOME management
➕ Aligns with Node’s built-in package manager workflow
➖ May not reliably handle pnpm v12 native-binary distribution and signature workflow across CI images
➖ Still requires careful PATH/profile handling in non-interactive CircleCI shells

2. Commit bundle pnpm settings as repo files

➕ Removes repetitive pnpm config set calls from CI
➕ Makes overrides and linker/import settings visible and reviewable as versioned files
➖ Bundle settings are build-artifact-specific and may not be appropriate for developer workflows
➖ Harder to vary Windows vs Linux behavior (e.g., preferSymlinkedExecutables) without templating

Recommendation: The PR’s approach (using get-pnpm for pnpm v12 and pnpm config set --location=project for all settings/overrides) is the most robust given pnpm 12’s changed config-reading behavior. Consider Corepack only if the CI environment guarantees consistent pnpm v12 support; otherwise the explicit installer + explicit config writes are clearer and less brittle.

Files changed (1) +46 / -56

Other (1) +46 / -56

config.ymlMigrate bundle jobs to pnpm v12 and native project-scoped configuration +46/-56

Migrate bundle jobs to pnpm v12 and native project-scoped configuration

• Updates the bundle install commands to write registry, linker/import options, overrides, and strictDepBuilds via 'pnpm config set --location=project' (removing '.npmrc' echoes and 'pnpm dlx' JSON patching). Switches pnpm installation to 'npx get-pnpm' with PNPM_HOME/PATH export for CircleCI shells, and merges the Windows-specific bundle install into the shared command via a 'prefer_symlinked_executables' parameter.

.circleci/config.yml

qodo-free-for-open-source-projects · 2026-08-18T12:54:30Z

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📜 Skill insights (0)

1. ~~Wrong pnpm PATH entry~~ ✓ Resolved 🐞 Bug ☼ Reliability

Description

setup_pnpm appends $PNPM_HOME/bin to PATH, but the surrounding comment indicates the PATH entry
written by pnpm setup is for PNPM_HOME itself; if the pnpm binary is placed directly under
PNPM_HOME, later steps won’t find pnpm and bundle jobs will fail.

Code

.circleci/config.yml[R272-275]

+            export PNPM_HOME="$HOME/.local/share/pnpm"
+            SHELL=/bin/bash npx --yes get-pnpm@0.0.3 12.0.0-rc.7
+            echo "export PNPM_HOME=\"$PNPM_HOME\"" >> $BASH_ENV
+            echo 'export PATH="$PNPM_HOME/bin:$PATH"' >> $BASH_ENV

Evidence

The code itself states that pnpm setup writes the PATH entry to ~/.bashrc and that PNPM_HOME
must be added to $BASH_ENV, but the implementation actually adds $PNPM_HOME/bin to PATH,
creating a mismatch that can prevent pnpm from being found in later steps.

.circleci/config.yml[262-276]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
CircleCI’s `setup_pnpm` command exports `PATH="$PNPM_HOME/bin:$PATH"`, which is inconsistent with the comment explaining that `pnpm setup` writes a PATH entry for `PNPM_HOME`. If pnpm ends up installed directly in `PNPM_HOME`, subsequent steps (e.g., `install_bit_bundle`) will fail with `pnpm: command not found`.
### Issue Context
This PR replaces npm-installed pnpm with `npx get-pnpm ...` and relies on `$BASH_ENV` for PATH propagation between steps.
### Fix Focus Areas
- .circleci/config.yml[272-275]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

Tip of the day

💡 Did you know, you can keep summaries lean with Finding overflow, which tucks the rest behind 'View more'

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

Previous review results

Review updated until commit 8eec7fd ⚖️ Balanced

Results up to commit N/A

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0) 🎨 UX issues (0) 🔗 Cross-repo conflicts (0) 📜 Skill insights (0)

1. ~~Wrong pnpm PATH entry~~ ✓ Resolved 🐞 Bug ☼ Reliability

Description

setup_pnpm appends $PNPM_HOME/bin to PATH, but the surrounding comment indicates the PATH entry
written by pnpm setup is for PNPM_HOME itself; if the pnpm binary is placed directly under
PNPM_HOME, later steps won’t find pnpm and bundle jobs will fail.

Code

.circleci/config.yml[R272-275]

+            export PNPM_HOME="$HOME/.local/share/pnpm"
+            SHELL=/bin/bash npx --yes get-pnpm@0.0.3 12.0.0-rc.7
+            echo "export PNPM_HOME=\"$PNPM_HOME\"" >> $BASH_ENV
+            echo 'export PATH="$PNPM_HOME/bin:$PATH"' >> $BASH_ENV

Evidence

The code itself states that pnpm setup writes the PATH entry to ~/.bashrc and that PNPM_HOME
must be added to $BASH_ENV, but the implementation actually adds $PNPM_HOME/bin to PATH,
creating a mismatch that can prevent pnpm from being found in later steps.

.circleci/config.yml[262-276]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
CircleCI’s `setup_pnpm` command exports `PATH="$PNPM_HOME/bin:$PATH"`, which is inconsistent with the comment explaining that `pnpm setup` writes a PATH entry for `PNPM_HOME`. If pnpm ends up installed directly in `PNPM_HOME`, subsequent steps (e.g., `install_bit_bundle`) will fail with `pnpm: command not found`.
### Issue Context
This PR replaces npm-installed pnpm with `npx get-pnpm ...` and relies on `$BASH_ENV` for PATH propagation between steps.
### Fix Focus Areas
- .circleci/config.yml[272-275]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

The check greps config.yml for the jsonmod-era spelling (`pnpm.overrides.@teambit/harmony" --values "0.4.12"`) and requires two hits, one per bundle-install step. The pin now lives once, as a line of the JSON object handed to `pnpm config set overrides`, so the check reads that spelling and expects a single override. `--fix` rewrites the same line. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

qodo-free-for-open-source-projects · 2026-08-18T12:58:09Z

Code Review by Qodo

New Review Started

This review has been superseded by a new analysis

`pnpm setup` installs into $PNPM_HOME/bin, which is the entry setup_pnpm writes to $BASH_ENV. Calling the binary at that path right after the install turns the assumption into a check: a layout change fails the install step with the path it looked at, rather than a later bundle job failing with "pnpm: command not found". Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

qodo-free-for-open-source-projects · 2026-08-18T12:59:53Z

Code Review by Qodo

New Review Started

This review has been superseded by a new analysis

qodo-free-for-open-source-projects · 2026-08-18T13:07:46Z

Code review by qodo was updated up to the latest commit 8eec7fd

qodo-free-for-open-source-projects Bot reviewed Aug 18, 2026

View reviewed changes

Comment thread .circleci/config.yml

Merge branch 'master' into ci-pnpm-v12

8eec7fd

Navigation Menu

Uh oh!

ci: install pnpm v12 and configure the bundle with native pnpm commands - #10627

ci: install pnpm v12 and configure the bundle with native pnpm commands#10627
zkochan wants to merge 4 commits into
teambit:masterfrom
zkochan:ci-pnpm-v12

zkochan commented Aug 18, 2026

Uh oh!

qodo-free-for-open-source-projects Bot commented Aug 18, 2026

Uh oh!

qodo-free-for-open-source-projects Bot commented Aug 18, 2026 •

edited

Loading

Uh oh!

Uh oh!

qodo-free-for-open-source-projects Bot commented Aug 18, 2026 •

edited

Loading

Uh oh!

qodo-free-for-open-source-projects Bot commented Aug 18, 2026 •

edited

Loading

Uh oh!

qodo-free-for-open-source-projects Bot commented Aug 18, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

zkochan commented Aug 18, 2026

Why the workarounds had to go

Two consequences of the version bump

Deduplication

Verification

Uh oh!

qodo-free-for-open-source-projects Bot commented Aug 18, 2026

PR Summary by Qodo

Uh oh!

qodo-free-for-open-source-projects Bot commented Aug 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Review by Qodo

Previous review results

Uh oh!

Uh oh!

qodo-free-for-open-source-projects Bot commented Aug 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Review by Qodo

New Review Started

Uh oh!

qodo-free-for-open-source-projects Bot commented Aug 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Review by Qodo

New Review Started

Uh oh!

qodo-free-for-open-source-projects Bot commented Aug 18, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

qodo-free-for-open-source-projects Bot commented Aug 18, 2026 •

edited

Loading

qodo-free-for-open-source-projects Bot commented Aug 18, 2026 •

edited

Loading

qodo-free-for-open-source-projects Bot commented Aug 18, 2026 •

edited

Loading