No sanctioned way to add a dependency: script/bootstrap is --frozen-lockfile and nothing updates the lockfile #45

New Issue

2026-08-09T17:10:25+02:00

clawbot commented

2026-08-09 17:10:25 +02:00

Problem

REPO_POLICIES.md requires that the underlying tools are never invoked directly — make targets and script/ entrypoints only. But there is no entrypoint that can add a dependency:

script/bootstrap runs yarn install --frozen-lockfile, which by definition refuses to modify yarn.lock.
No other script/ file touches the lockfile.

So adding a package requires a raw yarn add, which the policy forbids. This surfaced concretely in PR #44, where adding puppeteer-core needed exactly that; the deviation was disclosed and the result was verifiable after the fact, but it should not have required breaking a rule to do a routine thing.

The Go side has the same shape: nothing runs go get or go mod tidy, though REPO_POLICIES.md explicitly requires go mod tidy before committing.

Definition of done

A script/ entrypoint exists for adding or updating a JS dependency, shimmed from a make target, which updates package.json and yarn.lock together.
Equivalent for Go — at minimum a target that runs go mod tidy, since policy already mandates it before every commit and nothing currently provides it.
Documented in the README Entrypoints section.
script/bootstrap keeps --frozen-lockfile. That behaviour is correct and must not be relaxed to solve this — an install must never silently rewrite the lockfile.
Adding a dependency through the new entrypoint leaves yarn.lock reproducible under --frozen-lockfile, with integrity hashes intact.

Notes

Coordinate with #38, which restructures the script/ layer and splits frontend steps into script/frontend-*. Land after it, or match whatever naming it establishes.
Not on the 1.0.0 milestone — it is a workflow gap, not a release blocker.
No attribution trailers in the commit message.

## Problem `REPO_POLICIES.md` requires that the underlying tools are never invoked directly — `make` targets and `script/` entrypoints only. But there is no entrypoint that can **add** a dependency: - `script/bootstrap` runs `yarn install --frozen-lockfile`, which by definition refuses to modify `yarn.lock`. - No other `script/` file touches the lockfile. So adding a package requires a raw `yarn add`, which the policy forbids. This surfaced concretely in PR #44, where adding `puppeteer-core` needed exactly that; the deviation was disclosed and the result was verifiable after the fact, but it should not have required breaking a rule to do a routine thing. The Go side has the same shape: nothing runs `go get` or `go mod tidy`, though `REPO_POLICIES.md` explicitly requires `go mod tidy` before committing. ## Definition of done - [ ] A `script/` entrypoint exists for adding or updating a JS dependency, shimmed from a `make` target, which updates `package.json` and `yarn.lock` together. - [ ] Equivalent for Go — at minimum a target that runs `go mod tidy`, since policy already mandates it before every commit and nothing currently provides it. - [ ] Documented in the README **Entrypoints** section. - [ ] `script/bootstrap` keeps `--frozen-lockfile`. That behaviour is correct and must not be relaxed to solve this — an install must never silently rewrite the lockfile. - [ ] Adding a dependency through the new entrypoint leaves `yarn.lock` reproducible under `--frozen-lockfile`, with integrity hashes intact. ## Notes - Coordinate with #38, which restructures the `script/` layer and splits frontend steps into `script/frontend-*`. Land after it, or match whatever naming it establishes. - Not on the `1.0.0` milestone — it is a workflow gap, not a release blocker. - No attribution trailers in the commit message.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: sneak/netwatch#45