fix: retain candidate locks after frozen install failures

Keep failed frozen installs failed and restore committed inputs after diagnostic regeneration. Retain the normal installer candidate and status for cross-platform investigation.

Refs #3223

Refs stacksjs/ts-cloud#210

Refs stacksjs/hq.training#346

Author: chrisbbreuer

.github/scripts/diagnose-pantry-lock.test.ts

@@ -0,0 +1,38 @@
+import { expect, test } from 'bun:test'
+import { mkdtemp, readFile, rm, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { diagnosePantryLock } from './diagnose-pantry-lock'
+
+for (const exitCode of [0, 1]) {
+  test(`retains the actual candidate and restores inputs when regeneration exits ${exitCode}`, async () => {
+    const root = await mkdtemp(join(tmpdir(), 'pantry-lock-diagnostic-'))
+    try {
+      await writeFile(join(root, 'pantry.lock'), 'original lock\n')
+      const fixture = join(root, 'installer.ts')
+      await writeFile(fixture, `await Bun.write('pantry.lock', 'generated candidate\\n'); console.log('normal installer output'); process.exit(${exitCode})`)
+      expect(await diagnosePantryLock(root, [process.execPath, fixture])).toBe(exitCode)
+      expect(await readFile(join(root, 'pantry.lock'), 'utf8')).toBe('original lock\n')
+      const output = join(root, 'artifacts/pantry-lock-diagnostic')
+      expect(await readFile(join(output, 'committed.lock'), 'utf8')).toBe('original lock\n')
+      expect(await readFile(join(output, 'candidate.lock'), 'utf8')).toBe('generated candidate\n')
+      expect(await readFile(join(output, 'regeneration.stdout.log'), 'utf8')).toContain('normal installer output')
+      expect(JSON.parse(await readFile(join(output, 'result.json'), 'utf8')).exitCode).toBe(exitCode)
+    }
+    finally {
+      await rm(root, { recursive: true, force: true })
+    }
+  })
+}
+
+test('restores the committed input even when the diagnostic installer cannot start', async () => {
+  const root = await mkdtemp(join(tmpdir(), 'pantry-lock-diagnostic-'))
+  try {
+    await writeFile(join(root, 'pantry.lock'), 'original lock\n')
+    await expect(diagnosePantryLock(root, [join(root, 'missing-installer')])).rejects.toThrow()
+    expect(await readFile(join(root, 'pantry.lock'), 'utf8')).toBe('original lock\n')
+  }
+  finally {
+    await rm(root, { recursive: true, force: true })
+  }
+})

.github/scripts/diagnose-pantry-lock.ts

@@ -0,0 +1,29 @@
+import { mkdir, readFile, writeFile } from 'node:fs/promises'
+import { join, resolve } from 'node:path'
+
+/** A failed frozen check remains failed. This only retains the normal installer's candidate. */
+export async function diagnosePantryLock(root: string, command: string[] = ['pantry']): Promise<number> {
+  const lockPath = join(root, 'pantry.lock')
+  const original = await readFile(lockPath)
+  const output = join(root, 'artifacts', 'pantry-lock-diagnostic')
+  await mkdir(output, { recursive: true })
+  await writeFile(join(output, 'committed.lock'), original)
+  try {
+    const child = Bun.spawn([...command, 'install', '--ignore-scripts', '--quiet'], {
+      cwd: root,
+      stdout: Bun.file(join(output, 'regeneration.stdout.log')),
+      stderr: Bun.file(join(output, 'regeneration.stderr.log')),
+    })
+    const exitCode = await child.exited
+    await writeFile(join(output, 'candidate.lock'), await readFile(lockPath))
+    await writeFile(join(output, 'result.json'), `${JSON.stringify({ exitCode, platform: process.platform, arch: process.arch }, null, 2)}\n`)
+    return exitCode
+  }
+  finally {
+    // Diagnostic regeneration must never change the failed build's inputs.
+    await writeFile(lockPath, original)
+  }
+}
+
+if (import.meta.main)
+  process.exitCode = await diagnosePantryLock(resolve(import.meta.dir, '../..'))

.github/workflows/ci.yml

@@ -477,16 +477,22 @@ jobs:
         run: bun --no-env-file check-pantry-lock.ts
 
       - name: Install the pantry tree
+        id: pantry-tree
         run: pantry install --frozen-lockfile --ignore-scripts --quiet
 
-      - name: Retain the dependency lockfiles generated by the normal installers
+      - name: Retain the candidate after a failed frozen Pantry check
+        if: failure() && steps.pantry-tree.outcome == 'failure'
+        run: bun .github/scripts/diagnose-pantry-lock.ts
+
+      - name: Retain dependency lockfiles and failure diagnostics
         if: always()
         uses: actions/upload-artifact@v7
         with:
           name: dependency-lockfiles-${{ github.sha }}
           path: |
             bun.lock
             pantry.lock
+            artifacts/pantry-lock-diagnostic/
           if-no-files-found: error
 
       # The frozen install must still leave both committed lockfiles untouched.