[Question] Using with yarn's ---frozen-lockfile

[maciej-gurban]

Which Renovate are you using? CLI, App, or Pro

Self-hosted

Which platform are you using? GitHub, GitLab, Bitbucket Azure DevOps

Github

Context

Based on yarnpkg/yarn#4147, we're using .yarnrc file in which we set --install.frozen-lockfile true. This prevents us from introducing changes to yarn.lock when only installing already added dependencies.

However, this requires that to update the yarn.lock file when adding or upgrading dependencies we need to use yarn add or yarn upgrade command.

Today, we noticed that renovate PRs in our codebase fail, with:

The lock file failure details are included below:
yarn.lock
error Your lockfile needs to be updated, but yarn was run with `--frozen-lockfile`.

What is your question?

Does Renovate Bot simply modify contents of package.json without running commands like yarn upgrade? Is there a way to change that behavior, or otherwise solve this?

I tried replicating locally, and run yarn add foo, which updates yarn.lock and package.json. I then tried only changing the package.json to add that new package and running yarn in that scenario causes, as expected, Your lockfile needs to be updated, but yarn was run with --frozen-lockfile.

[maciej-gurban]

Checked renovate's source code, and it turns out that dependency versions are changed using string replace in package.json and then runs yarn install, hence why having --install.frozen-lockfile true would not produce yarn.lock and cause the above mentioned issue.

Hopefully yarn stops the install command from making changes to the lock file, so we get more predictable results. Until then, we simply remove the .yarnrc in CI.

[rarkins]

Can we massage the .yarnrc file before running yarn? We already have at least one case like that

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed soon if no further activity occurs.

[rarkins]

Can you copy in your exact yarnrc file here so I can use it in testing?

[maciej-gurban]

--install.frozen-lockfile true

[Shub1nk]

Faced the same problem and it is not clear how to solve it.

RenovateBot launched, created 2 PRs, but cannot update artifacts because yarn is launched with a flag --frozen-lockfile

[rarkins]

@Shub1nk Please create an issue in github.com/renovatebot/config-help with logs, exact .yarnrc, etc.