Skip to content

fix: use npx to invoke correct Yarn version instead of relying on Corepack PATH shims #78

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
iskounen merged 3 commits into from
Jun 25, 2026
Merged

fix: use npx to invoke correct Yarn version instead of relying on Corepack PATH shims #78

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
0322462
fix: use npx to invoke correct Yarn version instead of relying on Cor…
iskounen Jun 25, 2026
6f66316
fix: strip integrity hash from packageManager before passing to npx
iskounen Jun 25, 2026
165d786
fix: tighten Yarn 1 classifier to ^yarn@1\. to avoid matching yarn@10+
iskounen Jun 25, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
32 changes: 15 additions & 17 deletions .github/actions/setup-and-install/action.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,10 +17,6 @@ runs:
with:
node-version: ${{ inputs.node-version }}

- name: Enable Corepack
shell: bash
run: corepack enable

- name: Cache Yarn packages
uses: actions/cache@v4
with:
Expand All @@ -42,21 +38,23 @@ runs:
echo "Installing packages in: $INSTALL_DIR"
cd "$INSTALL_DIR"

# Activate the packageManager version via corepack so the global Yarn isn't used instead of the project's version
# Detect the Yarn version from the packageManager field and install with appropriate flags.
# For Yarn 1, npx is used to invoke the exact version rather than the global Yarn binary.
PKG_MANAGER=$(node -e "try{process.stdout.write(require('./package.json').packageManager||'')}catch(e){}" 2>/dev/null || echo "")
if [[ -n "$PKG_MANAGER" && "$PKG_MANAGER" =~ ^yarn@ ]]; then
echo "Activating $PKG_MANAGER via corepack"
corepack prepare "$PKG_MANAGER" --activate
fi

# Detect Yarn version and install with appropriate flags
YARN_VERSION=$(yarn --version)
if [[ "$YARN_VERSION" =~ ^[234] ]]; then
# Yarn 2+ (Berry)
echo "Detected Yarn $YARN_VERSION (Berry)"
if [[ "$PKG_MANAGER" =~ ^yarn@1\. ]]; then
echo "Detected Yarn 1 (Classic)"
npx --yes "${PKG_MANAGER%%+*}" install --frozen-lockfile
elif [[ -n "$PKG_MANAGER" && "$PKG_MANAGER" =~ ^yarn@ ]]; then
echo "Detected Yarn (Berry)"
yarn install --no-immutable
else
# Yarn 1 (Classic)
echo "Detected Yarn $YARN_VERSION (Classic)"
yarn install --frozen-lockfile
YARN_VERSION=$(yarn --version)
if [[ "$YARN_VERSION" =~ ^[234] ]]; then
echo "Detected Yarn $YARN_VERSION (Berry)"
yarn install --no-immutable
else
echo "Detected Yarn $YARN_VERSION (Classic)"
yarn install --frozen-lockfile
fi
fi
Comment on lines +45 to 60

@claude claude Bot Jun 25, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The Yarn 1 path was fixed to invoke the exact pinned version via npx, but the Berry path (line 48-50) and the fallback (line 51-60) still call the ambient global yarn. Since this PR removes corepack enable / corepack prepare --activate, a downstream repo with packageManager: yarn@3.x that calls this shared action would now run whatever yarn is on PATH (Yarn 1 on ubuntu-latest runners) instead of its pinned Berry version, unless their own workflow enables corepack.

This repo is unaffected (it's yarn@1.22.22, and danger.yml still runs corepack enable at the workflow level), so this isn't blocking. But for consistency with the npx approach, was leaving the Berry branch on ambient yarn intentional? It's an asymmetry worth a comment, or applying the same npx "${PKG_MANAGER%%+*}" treatment.

@iskounen iskounen Jun 25, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, downstream repos that use Barry (Yarn 2+) are expected to have the correct yarn version on PATH.

Loading