ci(publish-smoke): surface the app's resolved pnpm + build approvals before install (#3124)

[os-zhuang]

Closes#3124.

What was actually happening

The Publish Smoke gate died at the smoke app's install with
[ERR_PNPM_IGNORED_BUILDS] Ignored build scripts: better-sqlite3@…, esbuild@…
— for the exact two packages the allowlist names — and it never reproduced
locally (pnpm 10.31.0 / 10.33.0 both honor the allowlist and exit 0).

The missing fact, confirmed by local reproduction here:

• The scaffolded app declares no packageManager field (deliberate — the
  gate must test what a fresh user's pnpm resolves, not this repo's pin).
• With corepack enable (the workflow does this), corepack resolves the
  latest pnpm for a directory with no pin — pnpm 11.x, not the repo's
  pinned 10.31.0. Verified: corepack pnpm --version inside a /tmp app
  with no pin → 11.14.0, while the same command in the repo → 10.31.0.
• pnpm 11 turned an unapproved build script from a warning into a hard
  error. So the gate's local repro (pnpm 10.x, only warns) could never see
  the CI red (pnpm 11, hard error).

The app-side fix — declaring allowBuilds / onlyBuiltDependencies in the
scaffolded template so a fresh install passes on pnpm 11 — already landed in
#3119. I reproduced the full current flow (template pnpm-workspace.yaml

• the script's appended overrides: block, corepack pnpm@11.14.0, fresh
  store, CI=true, transitive better-sqlite3 + direct esbuild) and it now
  builds both and exits 0. The ERR_PNPM_IGNORED_BUILDS cause is resolved.

What this PR adds

The one thing #3124 explicitly asked to land first — visibility. Right
before the tarball-pinned install, the script now prints, from inside the app
dir:

• pnpm --version — so the pnpm/corepack version divergence is never invisible
  again;
• the build-approval keys pnpm actually resolved (only-built-dependencies,
  which pnpm derives from either allowBuilds or onlyBuiltDependencies), so a
  red run answers "did pnpm even see the approvals?" directly;
• the pnpm-workspace.yaml as written.

Diagnostics only, wrapped in || true — they can never fail the smoke. No
behavior change to the install itself.

Testing

• bash -n scripts/publish-smoke.sh — clean.
• Ran the diagnostic block against a representative app dir; it prints the
  resolved version, the only-built-dependencies[] entries pnpm parsed from
  both approval keys, and the workspace file.
• Faithful install repro on corepack pnpm@11.14.0 (fresh store, CI=true)
  with the current template + appended overrides: both esbuild and a
  transitive better-sqlite3 build, exit 0 — the ERR_PNPM_IGNORED_BUILDS
  failure does not recur.

🤖 Generated with Claude Code

---

Generated by Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
spec	Ready	Preview, Comment	Jul 18, 2026 1:30am