Add prepublish hook to unpin deps only for published version

beachball.config.js

@@ -1,3 +1,5 @@
+const fs = require("fs");
+
 // @ts-check
 /** @type {import('beachball').BeachballConfig}*/
 const config = {
@@ -7,12 +9,28 @@ const config = {
     groups: [
       {
         // roll up all changes to the lage changelog (packages still have individual changelogs too)
-        masterPackageName: "lage",
+        mainPackageName: "lage",
         include: ["packages/*"],
         changelogPath: "packages/lage",
       },
     ],
   },
+  hooks: {
+    prepublish: (packagePath, name, version, packageInfos) => {
+      const { packageJsonPath } = packageInfos[name];
+      const packageJson = require(packageJsonPath);
+      if (!packageJson.dependencies) return;
+
+      for (const [dep, version] of Object.entries(packageJson.dependencies)) {
+        // If the dep is a specific version, unpin before publishing.
+        // See the comment towards the end of renovate.json5 for why the deps are pinned to start out.
+        if (/\d/.test(version[0])) {
+          packageJson.dependencies[dep] = `^${version}`;
+        }
+      }
+      fs.writeFileSync(packageJsonPath, JSON.stringify(packageJson, null, 2) + "\n");
+    },
+  },
   ignorePatterns: [".*ignore", "jest.config.js", "**/__*/**/*", "**/tests/**/*"],
   disallowedChangeTypes: ["major"],
 };

change/change-0eb584c1-05cc-470b-b7ca-28ec3778bb0f.json

@@ -0,0 +1,32 @@
+{
+  "changes": [
+    {
+      "type": "patch",
+      "comment": "Bump and pin dependencies locally, but unpin them when the package is published",
+      "packageName": "@lage-run/cache",
+      "email": "elcraig@microsoft.com",
+      "dependentChangeType": "patch"
+    },
+    {
+      "type": "patch",
+      "comment": "Bump and pin dependencies locally, but unpin them when the package is published",
+      "packageName": "@lage-run/cli",
+      "email": "elcraig@microsoft.com",
+      "dependentChangeType": "patch"
+    },
+    {
+      "type": "patch",
+      "comment": "Bump and pin dependencies locally, but unpin them when the package is published",
+      "packageName": "@lage-run/rpc",
+      "email": "elcraig@microsoft.com",
+      "dependentChangeType": "patch"
+    },
+    {
+      "type": "patch",
+      "comment": "Bump and pin dependencies locally, but unpin them when the package is published",
+      "packageName": "@lage-run/target-graph",
+      "email": "elcraig@microsoft.com",
+      "dependentChangeType": "patch"
+    }
+  ]
+}

package.json

@@ -64,11 +64,5 @@
     "!(*test).{ts,js}": "eslint --fix",
     "*.{ts,json,md}": "prettier --write"
   },
-  "syncpack": {
-    "dependencyTypes": [
-      "dev",
-      "prod"
-    ]
-  },
   "packageManager": "yarn@4.12.0"
 }

packages/cache/package.json

@@ -18,7 +18,7 @@
   },
   "dependencies": {
     "@azure/core-auth": "1.10.1",
-    "@azure/identity": "^4.12.0",
+    "@azure/identity": "4.13.0",
     "@lage-run/config": "workspace:^",
     "@lage-run/logger": "workspace:^",
     "@lage-run/target-graph": "workspace:^",

packages/cli/package.json

@@ -38,9 +38,9 @@
     "commander": "9.5.0",
     "execa": "5.1.1",
     "fast-glob": "3.3.3",
-    "is-interactive": "^1.0.0",
-    "proper-lockfile": "^4.1.2",
-    "shell-quote": "^1.8.1",
+    "is-interactive": "1.0.0",
+    "proper-lockfile": "4.1.2",
+    "shell-quote": "1.8.3",
     "workspace-tools": "0.40.4"
   },
   "devDependencies": {

packages/rpc/package.json

@@ -13,19 +13,20 @@
   "scripts": {
     "lint": "buf lint",
     "generate": "buf generate",
-    "build": "tsc"
+    "build": "monorepo-scripts tsc"
   },
   "dependencies": {
-    "@bufbuild/protobuf": "^1.10.0",
-    "@connectrpc/connect": "^1.4.0",
-    "@connectrpc/connect-fastify": "^1.4.0",
-    "@connectrpc/connect-node": "^1.4.0",
-    "fastify": "^4.28.1"
+    "@bufbuild/protobuf": "1.10.1",
+    "@connectrpc/connect": "1.7.0",
+    "@connectrpc/connect-fastify": "1.7.0",
+    "@connectrpc/connect-node": "1.7.0",
+    "fastify": "4.29.1"
   },
   "devDependencies": {
     "@bufbuild/buf": "^1.39.0",
     "@bufbuild/protoc-gen-es": "^1.10.0",
-    "@connectrpc/protoc-gen-connect-es": "^1.4.0"
+    "@connectrpc/protoc-gen-connect-es": "1.7.0",
+    "@lage-run/monorepo-scripts": "workspace:^"
   },
   "publishConfig": {
     "access": "public"

packages/target-graph/package.json

@@ -17,8 +17,8 @@
     "lint": "monorepo-scripts lint"
   },
   "dependencies": {
-    "mergician": "^2.0.2",
-    "p-limit": "^3.1.0",
+    "mergician": "2.0.2",
+    "p-limit": "3.1.0",
     "workspace-tools": "0.40.4"
   },
   "devDependencies": {

renovate.json5

@@ -1,12 +1,12 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
   "extends": [
+    "github>microsoft/m365-renovate-config",
     "github>microsoft/m365-renovate-config:beachball",
     "github>microsoft/m365-renovate-config:disableEsmVersions",
     "github>microsoft/m365-renovate-config:groupMore",
     "github>microsoft/m365-renovate-config:groupTypes",
     "github>microsoft/m365-renovate-config:keepFresh",
-    "github>microsoft/m365-renovate-config:pinActions",
     "github>microsoft/m365-renovate-config:restrictNode(14)"
   ],
   "labels": ["renovate"],
@@ -40,30 +40,12 @@
       "dependencyDashboardApproval": false
     },
     {
-      // Don't try to pin or otherwise modify in-repo deps
-      "matchPackageNames": ["@lage-run/*"],
+      // There's a dev dep "lage-npm": "npm:lage@<..." intended to pull in a slightly older
+      // pre-built lage version for repo build orchestration (since local lage isn't built yet).
+      // Disable updating this with Renovate because it will choose a range that includes the
+      // latest version, which yarn will dedupe to the in-repo version.
+      "matchPackageNames": ["lage-npm"],
       "enabled": false
-    },
-    {
-      // lage bundles its dependencies, so any updates should to dependencies should be explicit
-      // so that they trigger a new lage version (with proper documentation of included updates).
-      // The standard approach of using ^ dependencies and allowing implicit updates via the lock file
-      // (which with a published bundle, are guaranteed to affect consumers) makes it very hard to
-      // track when an issue was introduced if it's discovered in another repo.
-      "rangeStrategy": "pin",
-      "matchFileNames": ["packages/**"], // ignore this for docs, scripts, root
-      "matchDepTypes": ["dependencies"],
-      "matchPackageNames": [
-        // lage packages aren't an issue since they're within the repo and the latest version is always used.
-        "!@lage-run/*",
-        // glob-hasher is a runtime dependency of lage since it publishes binaries.
-        "!glob-hasher"
-      ]
-    },
-    {
-      "matchManagers": ["github-actions"],
-      "groupName": "GitHub actions",
-      "dependencyDashboardApproval": false
     }
   ]
 }

syncpack.config.js

@@ -0,0 +1,39 @@
+// @ts-check
+
+// https://jamiemason.github.io/syncpack/
+/** @type {import('syncpack').RcFile} */
+const config = {
+  dependencyTypes: ["dev", "prod"],
+  versionGroups: [
+    {
+      label: "lage deps use workspace protocol",
+      dependencies: ["@lage-run/**"],
+      packages: ["**"],
+      specifierTypes: ["workspace-protocol"],
+    },
+  ],
+  semverGroups: [
+    {
+      // See below for explanation (this must come first in order)
+      label: "non-pinned dependencies",
+      range: "^",
+      dependencyTypes: ["prod"],
+      // glob-hasher is a runtime dependency of lage since it publishes binaries.
+      dependencies: ["glob-hasher"],
+    },
+    {
+      // lage bundles its dependencies, so any updates should to dependencies should be explicit
+      // so that they trigger a new lage version (with proper documentation of included updates).
+      // The standard approach of using ^ dependencies and allowing implicit updates via the lock file
+      // (which with a published bundle, are guaranteed to affect consumers) makes it very hard to
+      // track when an issue was introduced if it's discovered in another repo, so we pin deps locally.
+      // But since pinned deps are not great for anyone consuming the sub-packages directly, the
+      // beachball config includes a prepublish hook to unpin them.
+      label: "pin dependencies",
+      range: "",
+      dependencyTypes: ["prod"],
+      packages: ["!@lage-run/docs", "!@lage-run/monorepo-scripts"],
+    },
+  ],
+};
+module.exports = config;