fix(ci): validate declarations before frozen Pantry installs

Author: chrisbbreuer

.github/scripts/check-pantry-lock.ts

@@ -0,0 +1,12 @@
+import { readFileSync } from 'node:fs'
+import { resolve } from 'node:path'
+import { pantryLockViolations } from '../../storage/framework/core/actions/src/pantry-lock'
+
+// Keep declaration validation independent of a platform's registry resolution.
+const root = resolve(import.meta.dir, '../..')
+const lock = readFileSync(resolve(root, 'pantry.lock'), 'utf8')
+const bun = Bun.JSONC.parse(readFileSync(resolve(root, 'bun.lock'), 'utf8'))
+const violations = pantryLockViolations(lock, null, bun.workspaces)
+if (violations.length)
+  throw new Error(`Pantry lock does not describe this workspace:\n${violations.join('\n')}`)
+console.log('Pantry lock matches every current workspace declaration')

.github/workflows/ci.yml

@@ -456,13 +456,15 @@ jobs:
       - name: Install Dependencies
         run: bun install --frozen-lockfile
 
-      # The release job resolves through `pantry/`, not `node_modules`, and the
-      # two lockfiles pin different versions — the first attempt at this check
-      # passed here while the release still failed on a package `pantry.lock`
-      # held back. Install the same dependency tree without app setup,
-      # migrations or seeding, matching the normal release lock refresh.
+      # Validate declarations before a frozen install: a build consumes the
+      # committed graph, while the dependency-locks job generates updates.
+      # Registry changes to system dependencies must not rewrite build inputs.
+      - name: Validate the Pantry workspace lock
+        working-directory: .github/scripts
+        run: bun --no-env-file check-pantry-lock.ts
+
       - name: Install the pantry tree
-        run: pantry install --ignore-scripts --quiet
+        run: pantry install --frozen-lockfile --ignore-scripts --quiet
 
       - name: Retain the dependency lockfiles generated by the normal installers
         if: always()
@@ -474,20 +476,7 @@ jobs:
             pantry.lock
           if-no-files-found: error
 
-      # An install must not change the lockfile that describes it, so this
-      # installs the way a lock refresh does and asks git whether either
-      # lockfile moved.
-      #
-      # `pantry.lock` used to be compared structurally here. A Linux install
-      # rewrote a macOS-written lock until four fixes landed (pantry-pm/pantry#231,
-      # #232 and #233, and this repository's own lock in f21708e705), and after
-      # them it still added a GCC toolchain closure that macOS never resolves
-      # (stacksjs/stacks#2899). The committed lock now records that closure, and
-      # a Linux install and a macOS one both leave it byte-identical, so the
-      # comparison is strict again (stacksjs/stacks#2905).
-      #
-      # It does still go red when a declared range gains a release upstream,
-      # because pantry resolves past the pin the lock holds (pantry-pm/pantry#260).
+      # The frozen install must still leave both committed lockfiles untouched.
       - name: Check the lockfiles still describe this workspace
         run: |
           if ! git diff --exit-code -- bun.lock pantry.lock; then