fix(release): preserve unchanged native toolchain pins

Author: chrisbbreuer

pantry.lock

@@ -1547,11 +1547,11 @@
       "source": "pantry",
       "resolved": "registry:invisible-island.net/ncurses@6.6.0"
     },
-    "libexpat.github.io@2.9.0": {
+    "libexpat.github.io@2.10.0": {
       "name": "libexpat.github.io",
-      "version": "2.9.0",
+      "version": "2.10.0",
       "source": "pantry",
-      "resolved": "registry:libexpat.github.io@2.9.0"
+      "resolved": "registry:libexpat.github.io@2.10.0"
     },
     "lz4.org@1.11.0": {
       "name": "lz4.org",

storage/framework/core/actions/src/bump.ts

@@ -4,7 +4,7 @@ import { path as p } from '@stacksjs/path'
 import { incrementVersion, isReleaseType, isValidVersion, versionBump } from '@stacksjs/bumpx'
 import { isCalendarBump, nextCalendarVersion } from './calendar-version'
 import { describeGitHubRelease, publishGitHubRelease } from './github-release'
-import { pantryLockViolations } from './pantry-lock'
+import { pantryLockViolations, preservePantrySystemPins } from './pantry-lock'
 import { resolvePantryToolchain } from './pantry-toolchain'
 import { releasePushTarget } from './release-push-target'
 import { generateChangelog, loadLogsmithConfig } from '@stacksjs/logsmith'
@@ -307,6 +307,11 @@ async function refreshPantryLock(): Promise<void> {
     })
     if (!existsSync(lockPath))
       throw new Error('Pantry completed without writing pantry.lock')
+    if (isFrameworkRelease) {
+      // Refresh JS workspace versions, retaining CI's native graph when no
+      // system declaration changed. Pantry's platform resolution can differ.
+      writeFileSync(lockPath, preservePantrySystemPins(readFileSync(lockPath, 'utf8'), previousLock.toString('utf8')))
+    }
   }
   catch (error) {
     writeFileSync(lockPath, previousLock)

storage/framework/core/actions/src/pantry-lock.ts

@@ -49,6 +49,25 @@ interface PantryLock {
   packages?: Record<string, unknown>
 }
 
+/** An SDK version bump must not re-resolve an unchanged native toolchain for the publisher's OS. */
+export function preservePantrySystemPins(lock: string, baseline: string): string {
+  const next = JSON.parse(lock) as PantryLock
+  const previous = JSON.parse(baseline) as PantryLock
+  const systems = (value: PantryLock) => Object.entries(value.workspaces ?? {})
+    .filter(([, workspace]) => workspace.system && typeof workspace.system === 'object')
+    .map(([path, workspace]) => [path, Object.entries(workspace.system as Record<string, unknown>).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0)])
+    .sort(([a], [b]) => String(a) < String(b) ? -1 : String(a) > String(b) ? 1 : 0)
+  const declared = systems(previous)
+  if (!declared.length || JSON.stringify(declared) !== JSON.stringify(systems(next))) return lock
+  const native = (value: unknown) => !!value && typeof value === 'object' && (value as { source?: string }).source === 'pantry'
+  const pinned = Object.entries(previous.packages ?? {}).filter(([, value]) => native(value))
+  if (!pinned.length) return lock
+  const packages = Object.fromEntries(Object.entries(next.packages ?? {}).filter(([, value]) => !native(value)))
+  for (const [name, value] of pinned) packages[name] = value
+  next.packages = Object.fromEntries(Object.entries(packages).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0))
+  return `${JSON.stringify(next, null, 2)}\n`
+}
+
 /**
  * Split a `packages` key into its name and version.
  *

storage/framework/core/actions/tests/pantry-lock.test.ts

@@ -1,5 +1,5 @@
 import { describe, expect, it } from 'bun:test'
-import { pantryLockViolations } from '../src/pantry-lock'
+import { pantryLockViolations, preservePantrySystemPins } from '../src/pantry-lock'
 
 /**
  * The release guard for `pantry.lock` (stacksjs/stacks#2843).
@@ -38,6 +38,34 @@ const lockOf = (value: unknown) => JSON.stringify(value)
 const committed = lockOf(sound)
 const clone = () => JSON.parse(committed) as typeof sound
 
+describe('release native toolchain pins', () => {
+  const previous = { ...sound, packages: { ...sound.packages,
+    'libexpat.github.io@2.10.0': { name: 'libexpat.github.io', version: '2.10.0', source: 'pantry' },
+  } }
+  const regenerated = { ...sound, packages: {
+    'pickier@0.1.66': { name: 'pickier', version: '0.1.66' },
+    'libexpat.github.io@2.9.0': { name: 'libexpat.github.io', version: '2.9.0', source: 'pantry' },
+  } }
+
+  it('keeps the validated system graph while refreshing JS resolutions', () => {
+    const result = JSON.parse(preservePantrySystemPins(lockOf(regenerated), lockOf(previous)))
+    expect(result.packages['libexpat.github.io@2.10.0'].version).toBe('2.10.0')
+    expect(result.packages['libexpat.github.io@2.9.0']).toBeUndefined()
+    expect(result.packages['pickier@0.1.66'].version).toBe('0.1.66')
+    expect(result.packages['pickier@0.1.65']).toBeUndefined()
+  })
+
+  it('allows an intentional native toolchain declaration change', () => {
+    const changed = JSON.parse(lockOf(regenerated))
+    changed.workspaces[''].system['bun.sh'] = '1.4.3'
+    expect(preservePantrySystemPins(lockOf(changed), lockOf(previous))).toBe(lockOf(changed))
+  })
+
+  it('does not invent a system graph for projects that declared none', () => {
+    expect(preservePantrySystemPins(lockOf(regenerated), '{"packages":{}}')).toBe(lockOf(regenerated))
+  })
+})
+
 describe('pantryLockViolations', () => {
   it('rejects a self-consistent lock that still records the previous release declarations', () => {
     const expected = clone().workspaces