From 32e40cbbb4906e57704826b4dab88e3b7904de97 Mon Sep 17 00:00:00 2001
From: dongmucat <1127093059@qq.com>
Date: Sat, 9 May 2026 10:46:48 +0800
Subject: [PATCH] fix(ci): pin pnpm 10.33 and approve esbuild build scripts

Corepack was resolving pnpm to latest (11.0.9) on each CI run, and
pnpm 11 refuses unapproved postinstall scripts in --frozen-lockfile
mode. That caused ERR_PNPM_IGNORED_BUILDS: esbuild@0.25.12 and failed
the web image build in publish-images.

Changes:
- web/package.json: pin packageManager to pnpm@10.33.0
- web/pnpm-workspace.yaml: approve esbuild via onlyBuiltDependencies
  (pnpm 10 syntax; matches the pinned major)
- web/Dockerfile: copy pnpm-workspace.yaml before pnpm install so the
  approval list is visible inside the build stage
---
 web/Dockerfile          | 2 +-
 web/package.json        | 1 +
 web/pnpm-workspace.yaml | 5 +++++
 3 files changed, 7 insertions(+), 1 deletion(-)
 create mode 100644 web/pnpm-workspace.yaml

diff --git a/web/Dockerfile b/web/Dockerfile
index e301f7c8..d3dd090b 100644
--- a/web/Dockerfile
+++ b/web/Dockerfile
@@ -1,7 +1,7 @@
 FROM node:22-alpine AS build
 RUN corepack enable
 WORKDIR /app
-COPY package.json pnpm-lock.yaml ./
+COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
 RUN pnpm install --frozen-lockfile
 COPY . .
 RUN pnpm build
diff --git a/web/package.json b/web/package.json
index 6b05b007..b8083426 100644
--- a/web/package.json
+++ b/web/package.json
@@ -3,6 +3,7 @@
   "private": true,
   "version": "0.1.0",
   "type": "module",
+  "packageManager": "pnpm@10.33.0",
   "scripts": {
     "install:ci": "pnpm install --frozen-lockfile",
     "dev": "vite",
diff --git a/web/pnpm-workspace.yaml b/web/pnpm-workspace.yaml
new file mode 100644
index 00000000..8ddd474f
--- /dev/null
+++ b/web/pnpm-workspace.yaml
@@ -0,0 +1,5 @@
+packages:
+  - '.'
+
+onlyBuiltDependencies:
+  - esbuild