Skip to content

feat(cli): install global dependencies from release and preview lockfiles - #3117

Merged
fengmk2 merged 19 commits into
mainfrom
feat/installer-release-lockfile
Oct 20, 2026
Merged

fengmk2 merged 19 commits into
mainfrom
feat/installer-release-lockfile

Conversation

@fengmk2

@fengmk2 fengmk2 commented Oct 19, 2026 •

Copy link
Copy Markdown
Member

Generate an installation lockfile during release and preview publication, so each CLI version installs the same dependency versions.

Blue shows the new steps. The dashed path shows the previous behavior.

flowchart LR
    Local["Publish local CLI<br/>staging / commit version"] --> Lock["pnpm generates lockfile<br/>Save for retries"]
    Lock --> Global["Publish global CLI<br/>binary + lockfile<br/>Then update latest / PR tag"]
    Global --> Install["Install / upgrade<br/>--frozen-lockfile"]
    Local -. "Previously: no lockfile" .-> Resolve["Resolve dependencies<br/>during installation"]

    classDef added fill:#dbeafe,stroke:#2563eb,color:#0f172a,stroke-width:2px;
    classDef previous fill:#f3f4f6,stroke:#9ca3af,color:#4b5563,stroke-dasharray:4 4;
    class Local,Lock,Global,Install added;
    class Resolve previous;
Loading

The lockfile is inside each global CLI platform package, beside vp or vp.exe. Pnpm generates a standard pnpm-lock.yaml from the published local CLI version. Packaging preserves its contents as vp-install-lock.yaml. The installer restores it as pnpm-lock.yaml. Standalone release archives also contain it.

Releases use staging until all global packages are available, then promote the local CLI to latest. Previews use the exact commit version and update pr-<number> last. Preview lockfile generation runs without publishing credentials.

Use Re-run failed jobs to resume publication. Retries skip accepted npm versions and reuse saved or published lockfiles. Artifact uploads can repeat, and GitHub release retries preserve published assets.

The generator and installers pin pnpm 10.34.7. Older packages without a lockfile retain their existing behavior. minimum-release-age=0 still allows immediate installation of new versions.

Set VP_SETUP_SKIP_INSTALL_LOCKFILE=1 to recover from installation lockfile errors during setup or upgrades. The installer resolves dependencies again and keeps the requested CLI version.

Release setup: enable Allow npm dist-tag for the vite-plus trusted publisher in release.yml. See npm's trusted publishing documentation.

Fixes #2850.

@cloudflare-workers-and-pages

cloudflare-workers-and-pages Bot commented Oct 19, 2026 •

Copy link
Copy Markdown

🚀 Deploying Preview to Cloudflare 🚀

Preview URL: https://feat-installer-release-lockfile-viteplus-dev.voidzero-docs.workers.dev (commit 2a23a0c)

This URL reflects your latest Preview deployment

Preview Deployments by commit

Status Deployment URL Commit Updated (UTC) See this deployment's details
  • Build: Success ✅
  • Deployment: Success ✅

View logs ↗
https://eae809da-viteplus-dev.voidzero-docs.workers.dev 2a23a0c 2026-10-20T14:40:52.146Z Visit the dashboard ↗
  • Build: Success ✅
  • Deployment: Success ✅

View logs ↗
https://888d3b14-viteplus-dev.voidzero-docs.workers.dev 1e59da0 2026-10-20T14:14:54.343Z Visit the dashboard ↗
  • Build: Success ✅
  • Deployment: Success ✅

View logs ↗
https://e5111303-viteplus-dev.voidzero-docs.workers.dev e38722b 2026-10-20T14:00:12.630Z Visit the dashboard ↗
  • Build: Success ✅
  • Deployment: Success ✅

View logs ↗
https://3f45193c-viteplus-dev.voidzero-docs.workers.dev a63a1a7 2026-10-20T13:19:47.707Z Visit the dashboard ↗
  • Build: Success ✅
  • Deployment: Success ✅

View logs ↗
https://93a8c165-viteplus-dev.voidzero-docs.workers.dev 2034f9d 2026-10-20T12:20:59.504Z Visit the dashboard ↗
  • Build: Success ✅
  • Deployment: Success ✅

View logs ↗
https://f9347880-viteplus-dev.voidzero-docs.workers.dev d6342e7 2026-10-20T12:09:52.901Z Visit the dashboard ↗
  • Build: Success ✅
  • Deployment: Success ✅

View logs ↗
https://5a45b7e2-viteplus-dev.voidzero-docs.workers.dev 1bff030 2026-10-20T09:45:42.481Z Visit the dashboard ↗
  • Build: Success ✅
  • Deployment: Success ✅

View logs ↗
https://fdf9830f-viteplus-dev.voidzero-docs.workers.dev 4ddc39c 2026-10-20T08:13:32.528Z Visit the dashboard ↗
  • Build: Success ✅
  • Deployment: Success ✅

View logs ↗
https://cbb1e8a4-viteplus-dev.voidzero-docs.workers.dev db8edb5 2026-10-20T07:35:09.820Z Visit the dashboard ↗
  • Build: Success ✅
  • Deployment: Success ✅

View logs ↗
https://152d8dea-viteplus-dev.voidzero-docs.workers.dev 824022c 2026-10-20T06:57:53.737Z Visit the dashboard ↗

View all previews: View all previews ↗

@github-actions

github-actions Bot commented Oct 19, 2026 •

Copy link
Copy Markdown
Contributor

CLI artifact sizes (2a23a0c)

Final release artifacts built by the canonical build-upstream and build-windows-cli actions.
The dist rows use the Linux build. The core total excludes .node files to match the release artifact.

Artifact Format Base PR Change
packages/cli/dist Directory total 2.14 MiB 2.14 MiB 0 B (0.00%)
packages/core/dist Directory total 4.08 MiB 4.08 MiB 0 B (0.00%)
Combined package dist Directory total 6.23 MiB 6.23 MiB 0 B (0.00%)
vp (Linux x64) Binary 7.22 MiB 7.26 MiB +44.00 KiB (+0.60%)
vp (Linux x64) gzip -9 3.35 MiB 3.37 MiB +16.52 KiB (+0.48%)
NAPI (Linux x64) Binary 35.14 MiB 35.14 MiB 0 B (0.00%)
NAPI (Linux x64) gzip -9 14.01 MiB 14.01 MiB +282 B (+0.00%)
vp (macOS ARM64) Binary 4.77 MiB 4.82 MiB +48.63 KiB (+0.99%)
vp (macOS ARM64) gzip -9 2.87 MiB 2.88 MiB +13.08 KiB (+0.45%)
NAPI (macOS ARM64) Binary 42.01 MiB 42.01 MiB 0 B (0.00%)
NAPI (macOS ARM64) gzip -9 18.16 MiB 18.17 MiB +196 B (+0.00%)
vp (Windows x64) Binary 5.27 MiB 5.31 MiB +32.50 KiB (+0.60%)
vp (Windows x64) gzip -9 2.46 MiB 2.48 MiB +15.66 KiB (+0.62%)
NAPI (Windows x64) Binary 31.20 MiB 31.20 MiB 0 B (0.00%)
NAPI (Windows x64) gzip -9 12.72 MiB 12.72 MiB +448 B (+0.00%)
Trampoline (Windows x64) Binary 13.50 KiB 13.50 KiB 0 B (0.00%)
Trampoline (Windows x64) gzip -9 7.09 KiB 7.09 KiB 0 B (0.00%)
Installer (Windows x64) Binary 3.64 MiB 3.66 MiB +22.50 KiB (+0.60%)
Installer (Windows x64) gzip -9 1.78 MiB 1.79 MiB +10.35 KiB (+0.57%)

@fengmk2 fengmk2 changed the title feat(cli): install global dependencies from release lockfiles feat(cli): install global dependencies from release and preview lockfiles Oct 19, 2026
@fengmk2

fengmk2 commented Oct 19, 2026

Copy link
Copy Markdown
Member Author

@codex review

@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Oct 19, 2026 •

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review ✅ Completed 2026-10-20T05:30:07.029725Z — Manual request
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

@chatgpt-codex-connector

Copy link
Copy Markdown

Codex Review: Didn't find any major issues. You're on a roll.

Reviewed commit: 83864f567a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

@github-actions

github-actions Bot commented Oct 19, 2026 •

Copy link
Copy Markdown
Contributor

✅ Staging deployment successful!

Preview: https://viteplus-staging.void.app/
Commit: 2a23a0c

@fengmk2

fengmk2 commented Oct 19, 2026

Copy link
Copy Markdown
Member Author

@codex review

@fengmk2 fengmk2 self-assigned this Oct 19, 2026
@fengmk2 fengmk2 added preview-build Publish this PR's commits to the registry bridge as preview builds and removed preview-build Publish this PR's commits to the registry bridge as preview builds labels Oct 19, 2026

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 0f8577ec7b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread crates/vp_global_cli/src/self_setup.rs Outdated
Comment thread crates/vp_setup/src/lockfile.rs Outdated
@fengmk2 fengmk2 added the preview-build Publish this PR's commits to the registry bridge as preview builds label Oct 19, 2026
@github-actions

github-actions Bot commented Oct 19, 2026 •

Copy link
Copy Markdown
Contributor

Preview binary sizes (824022c)

Compared with the latest stable release, v1.3.0. Preview build.
Each row measures one binary. Negative changes mean a smaller preview binary.

Binary Latest release Preview Change
vp (macOS ARM64) 7.62 MiB 4.79 MiB -2.83 MiB (-37.17%)
NAPI (macOS ARM64) 41.49 MiB 41.68 MiB +193.73 KiB (+0.46%)
vp (macOS x64) 9.29 MiB 6.04 MiB -3.25 MiB (-34.97%)
NAPI (macOS x64) 46.44 MiB 46.71 MiB +272.26 KiB (+0.57%)
vp (Linux ARM64 GNU) 8.48 MiB 6.02 MiB -2.46 MiB (-28.98%)
NAPI (Linux ARM64 GNU) 30.66 MiB 30.86 MiB +204.00 KiB (+0.65%)
vp (Linux ARM64 musl) 8.53 MiB 6.10 MiB -2.43 MiB (-28.51%)
NAPI (Linux ARM64 musl) 29.89 MiB 30.07 MiB +185.94 KiB (+0.61%)
vp (Linux x64 GNU) 10.21 MiB 7.24 MiB -2.98 MiB (-29.14%)
NAPI (Linux x64 GNU) 34.53 MiB 34.79 MiB +267.94 KiB (+0.76%)
vp (Linux x64 musl) 10.21 MiB 7.30 MiB -2.91 MiB (-28.49%)
NAPI (Linux x64 musl) 33.50 MiB 33.76 MiB +269.31 KiB (+0.79%)
vp (Windows x64) 8.29 MiB 5.29 MiB -3.00 MiB (-36.22%)
NAPI (Windows x64) 30.25 MiB 30.50 MiB +264.50 KiB (+0.85%)
Trampoline (Windows x64) 13.00 KiB 13.00 KiB 0 B (0.00%)
Installer (Windows x64) 3.64 MiB 3.66 MiB +21.50 KiB (+0.58%)
vp (Windows ARM64) 6.94 MiB 4.65 MiB -2.29 MiB (-32.99%)
NAPI (Windows ARM64) 26.83 MiB 27.01 MiB +185.50 KiB (+0.68%)
Trampoline (Windows ARM64) 13.00 KiB 13.00 KiB 0 B (0.00%)
Installer (Windows ARM64) 3.01 MiB 3.03 MiB +18.50 KiB (+0.60%)
gzip -9 sizes
Binary Latest release Preview Change
vp (macOS ARM64) 3.94 MiB 2.87 MiB -1.07 MiB (-27.16%)
NAPI (macOS ARM64) 17.97 MiB 18.01 MiB +47.53 KiB (+0.26%)
vp (macOS x64) 4.28 MiB 3.03 MiB -1.25 MiB (-29.21%)
NAPI (macOS x64) 19.14 MiB 19.19 MiB +47.20 KiB (+0.24%)
vp (Linux ARM64 GNU) 4.26 MiB 3.30 MiB -982.17 KiB (-22.50%)
NAPI (Linux ARM64 GNU) 13.00 MiB 13.05 MiB +50.59 KiB (+0.38%)
vp (Linux ARM64 musl) 4.30 MiB 3.33 MiB -996.07 KiB (-22.60%)
NAPI (Linux ARM64 musl) 12.71 MiB 12.76 MiB +49.84 KiB (+0.38%)
vp (Linux x64 GNU) 4.50 MiB 3.35 MiB -1.15 MiB (-25.53%)
NAPI (Linux x64 GNU) 13.81 MiB 13.86 MiB +50.95 KiB (+0.36%)
vp (Linux x64 musl) 4.51 MiB 3.38 MiB -1.13 MiB (-24.99%)
NAPI (Linux x64 musl) 13.35 MiB 13.40 MiB +51.98 KiB (+0.38%)
vp (Windows x64) 3.66 MiB 2.47 MiB -1.18 MiB (-32.38%)
NAPI (Windows x64) 12.37 MiB 12.42 MiB +43.65 KiB (+0.34%)
Trampoline (Windows x64) 7.14 KiB 7.14 KiB 0 B (0.00%)
Installer (Windows x64) 1.78 MiB 1.79 MiB +9.79 KiB (+0.54%)
vp (Windows ARM64) 3.46 MiB 2.37 MiB -1.09 MiB (-31.60%)
NAPI (Windows ARM64) 11.75 MiB 11.79 MiB +41.77 KiB (+0.35%)
Trampoline (Windows ARM64) 6.93 KiB 6.93 KiB -2 B (-0.03%)
Installer (Windows ARM64) 1.71 MiB 1.72 MiB +8.40 KiB (+0.48%)

Raw sizes are uncompressed file sizes. gzip sizes recompress each binary at level 9; they are not package or download archive sizes.
The baseline uses published release files, including NAPI packages from npm at the same version. Build versions and toolchains can affect the difference.

@github-actions

github-actions Bot commented Oct 19, 2026 •

Copy link
Copy Markdown
Contributor

Registry bridge build (824022c)

This commit build is published to the registry bridge, which serves these as ordinary npm versions (every other package proxies to npmjs):

Package Version
vite-plus 0.0.0-commit.824022c87532ff89b4d7783873092eb2712b97d5
@voidzero-dev/vite-plus-core 0.0.0-commit.824022c87532ff89b4d7783873092eb2712b97d5
create-vite-plus 0.0.0-commit.824022c87532ff89b4d7783873092eb2712b97d5

Install the Vite+ CLI built from this commit, then migrate a project:

# macOS / Linux
curl -fsSL https://raw.githubusercontent.com/voidzero-dev/vite-plus/824022c87532ff89b4d7783873092eb2712b97d5/packages/cli/install.sh | VP_PR_VERSION=3117 VP_LEGACY_INSTALLER_URL=https://raw.githubusercontent.com/voidzero-dev/vite-plus/824022c87532ff89b4d7783873092eb2712b97d5/packages/cli/install-legacy.sh bash
# Windows (PowerShell)
$env:VP_PR_VERSION="3117"; $env:VP_LEGACY_INSTALLER_URL="https://raw.githubusercontent.com/voidzero-dev/vite-plus/824022c87532ff89b4d7783873092eb2712b97d5/packages/cli/install-legacy.ps1"; irm https://raw.githubusercontent.com/voidzero-dev/vite-plus/824022c87532ff89b4d7783873092eb2712b97d5/packages/cli/install.ps1 | iex

Or download the standalone Windows installer built from this commit:

Architecture Installer
x64 vp-setup-x86_64-pc-windows-msvc.exe
Arm64 vp-setup-aarch64-pc-windows-msvc.exe

GitHub requires you to sign in and downloads each installer as a ZIP artifact. Extract vp-setup.exe, then run it against this preview build:

.\vp-setup.exe --version "0.0.0-commit.824022c87532ff89b4d7783873092eb2712b97d5" --registry "https://registry-bridge.viteplus.dev/"

After installing, upgrade the current project's vite-plus to this test build with:

vp migrate

Or create a new project from this commit without installing the CLI:

export npm_config_registry=https://registry-bridge.viteplus.dev/ pnpm_config_registry=https://registry-bridge.viteplus.dev/
pnpm create vite-plus@0.0.0-commit.824022c87532ff89b4d7783873092eb2712b97d5 # or: npm create vite-plus@0.0.0-commit.824022c87532ff89b4d7783873092eb2712b97d5
$env:npm_config_registry="https://registry-bridge.viteplus.dev/"; $env:pnpm_config_registry="https://registry-bridge.viteplus.dev/"
pnpm create vite-plus@0.0.0-commit.824022c87532ff89b4d7783873092eb2712b97d5 # or: npm create vite-plus@0.0.0-commit.824022c87532ff89b4d7783873092eb2712b97d5

pnpm 11+ reads pnpm_config_registry, npm and older pnpm read npm_config_registry. The new project pins this build, so keep the registry set for later installs, or configure it as below.

Or point your package manager at the bridge registry https://registry-bridge.viteplus.dev/:

Package manager Registry config
npm / pnpm / Bun .npmrc: registry=https://registry-bridge.viteplus.dev/
Yarn (v2+) .yarnrc.yml: npmRegistryServer: "https://registry-bridge.viteplus.dev/"

Then pin the build (vite aliases to vite-plus-core; pnpm can use a catalog, npm an overrides entry):

{
  "devDependencies": {
    "vite-plus": "0.0.0-commit.824022c87532ff89b4d7783873092eb2712b97d5",
    "vite": "npm:@voidzero-dev/vite-plus-core@0.0.0-commit.824022c87532ff89b4d7783873092eb2712b97d5"
  }
}

@fengmk2

This comment was marked as resolved.

@fengmk2
fengmk2 force-pushed the feat/installer-release-lockfile branch from 904fd57 to 6532170 Compare October 20, 2026 04:36
@fengmk2 fengmk2 added preview-build Publish this PR's commits to the registry bridge as preview builds and removed preview-build Publish this PR's commits to the registry bridge as preview builds labels Oct 20, 2026
@fengmk2

fengmk2 commented Oct 20, 2026

Copy link
Copy Markdown
Member Author

@codex review

@chatgpt-codex-connector

Copy link
Copy Markdown

Codex Review: Didn't find any major issues. Keep it up!

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

@fengmk2 fengmk2 added preview-build Publish this PR's commits to the registry bridge as preview builds and removed preview-build Publish this PR's commits to the registry bridge as preview builds labels Oct 20, 2026
@github-actions

Copy link
Copy Markdown
Contributor

🐳 Docker preview image

Built from this PR's registry bridge build:

Image Compressed size
ghcr.io/voidzero-dev/vite-plus:pr-3117 220MB
# remove any stale local copy from a previous run, then pull fresh
docker rmi ghcr.io/voidzero-dev/vite-plus:pr-3117 2>/dev/null; docker pull ghcr.io/voidzero-dev/vite-plus:pr-3117

Quick check:

docker run --rm ghcr.io/voidzero-dev/vite-plus:pr-3117 vp --version

See docs/guide/docker.md for usage.

@fengmk2
fengmk2 marked this pull request as ready for review October 20, 2026 08:38
@fengmk2
fengmk2 requested review from cpojer and wan9chi October 20, 2026 08:38
@fengmk2
fengmk2 force-pushed the feat/installer-release-lockfile branch from 1bff030 to d6342e7 Compare October 20, 2026 12:09
@fengmk2
fengmk2 force-pushed the feat/installer-release-lockfile branch from 1e59da0 to 2a23a0c Compare October 20, 2026 14:38
@fengmk2
fengmk2 merged commit 0cbfb6d into main Oct 20, 2026
126 of 129 checks passed
@fengmk2
fengmk2 deleted the feat/installer-release-lockfile branch October 20, 2026 15:17
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

preview-build Publish this PR's commits to the registry bridge as preview builds

Projects

None yet

Development

Successfully merging this pull request may close these issues.

install.sh resolves CLI dependencies at install time, project lockfile and overrides cannot pin them (std-env 4.3.0 404 broke CI)

3 participants