You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
description: Use when user adds package with postinstall script (supabase, sharp), gets "binary not found" errors in CI, or asks about onlyBuiltDependencies. Explains the two-step pattern for managing packages that need build/postinstall scripts in pnpm workspaces with frozen lockfiles.
4
+
---
5
+
6
+
# pnpm Postinstall Dependencies
7
+
8
+
Manage packages that need postinstall scripts in pnpm workspaces.
9
+
10
+
## The Problem
11
+
12
+
`pnpm install --frozen-lockfile --prefer-offline` in CI restores from cache and skips postinstall scripts. Packages like `supabase` download binaries via postinstall - without it, the binary doesn't exist.
13
+
14
+
## The Pattern
15
+
16
+
**Two-step sync required:**
17
+
18
+
1.**pnpm-workspace.yaml** - Declares which packages are allowed to run build scripts
19
+
2.**Setup action** - Explicitly rebuilds those packages after install
20
+
21
+
<critical>
22
+
Both lists MUST stay in sync. If they diverge:
23
+
- Missing in yaml → Package can't run postinstall (security)
24
+
- Missing in action → Binary won't be available in CI
25
+
</critical>
26
+
27
+
## Checklist
28
+
29
+
When adding a package that needs postinstall:
30
+
31
+
### 1. Add to pnpm-workspace.yaml
32
+
33
+
```yaml
34
+
onlyBuiltDependencies:
35
+
- supabase
36
+
- sharp
37
+
- your-new-package # Add here
38
+
```
39
+
40
+
### 2. Update .github/actions/setup/action.yml
41
+
42
+
```yaml
43
+
- name: Rebuild packages that need postinstall (onlyBuiltDependencies)
44
+
shell: bash
45
+
run: pnpm rebuild supabase sharp your-new-package # Add here
46
+
```
47
+
48
+
### 3. Verify
49
+
50
+
Check both files have identical package lists.
51
+
52
+
## Why Explicit Package Names?
53
+
54
+
`pnpm rebuild --pending` is too implicit - unclear if it respects onlyBuiltDependencies. Explicit names guarantee behavior and make configuration visible.
55
+
56
+
## Common Packages
57
+
58
+
- `supabase`- Downloads CLI binary from GitHub releases
0 commit comments