Fix corrupted pnpm-lock.yaml and clean health check JSON output by Copilot · Pull Request #79 · CastQuest/castquest-frames

Copilot · 2026-01-25T03:36:12Z

The lockfile had a missing dependency entry for drizzle-orm@0.29.5 with peer dependencies, causing ERR_PNPM_LOCKFILE_MISSING_DEPENDENCY in CI. Additionally, pnpm's stdout was polluting the health check JSON output.

Changes

pnpm-lock.yaml

Regenerated to restore missing dependency entries

scripts/master.sh

Redirect pnpm output to stderr in ensure_pnpm_install() to prevent JSON pollution:

$PNPM install --frozen-lockfile >&2 || $PNPM install >&2 || true

scripts/repair-dependencies.sh

Add lockfile integrity verification after regeneration:

if pnpm install --frozen-lockfile 2>&1; then
  log_success "Lockfile is valid and consistent"
else
  log_error "Lockfile validation failed - may need manual intervention"
  return 1
fi

.github/workflows/dependency-health.yml

Add inline troubleshooting comments for lockfile failures

Result

pnpm install --frozen-lockfile succeeds without errors
Health check generates clean, parseable JSON
Repair script validates lockfile integrity

Original prompt

🏥 SURGICAL DIRECTIVE: EMERGENCY INTERVENTION

╔══════════════════════════════════════════════════════════╗
║  DIAGNOSIS: ROOT CAUSE IDENTIFIED                        ║
║  PATHOLOGY: LOCKFILE CORRUPTION + HEALTH CHECK FAILURE   ║
║  SEVERITY: CRITICAL (REQUIRES IMMEDIATE SURGERY)         ║
╚══════════════════════════════════════════════════════════╝

🔴 CRITICAL ISSUE

Issue Reference: #78 (and #69, #70, #72, #73, #74, #75, #77)
Workflow Run: https://github.com/CastQuest/castquest-frames/actions/runs/21326074598
Status: 8 consecutive health check failures over 9 days

📋 ROOT CAUSE ANALYSIS

Problem 1: Corrupted pnpm-lock.yaml

Error from CI logs:

ERR_PNPM_LOCKFILE_MISSING_DEPENDENCY  Broken lockfile: no entry for 'drizzle-orm@0.29.5(@cloudflare/workers-types@4.20260103.0)(@types/pg@8.16.0)(@types/react@18.2.79)(pg@8.16.3)(react@18.2.0)' in pnpm-lock.yaml

This issue is probably caused by a badly resolved merge conflict.
To fix the lockfile, run 'pnpm install --no-frozen-lockfile'.

Root Cause: The lockfile has a missing dependency entry for drizzle-orm@0.29.5 with specific peer dependency resolution. This breaks the --frozen-lockfile installation in CI.

Impact:

CI workflow fails at dependency installation step
Health check cannot run
Automated issue creation creates duplicate issues (🚨 Dependency Health Check Failed #69-🚨 Dependency Health Check Failed #78)

Problem 2: Missing Health Check Script

Error from workflow:

- name: Set workflow status
  if: always()
  run: |
    node scripts/health/check-health.js health-report.json

Root Cause: The workflow references scripts/health/check-health.js which does NOT exist in the repository.

Impact:

Workflow fails even if health checks pass
False positive failures reported
Noise in CI logs

🎯 SURGICAL OBJECTIVES

Primary Objectives (Option A + B Combined)

IMMEDIATE FIX (Option A):
- ✅ Regenerate pnpm-lock.yaml to resolve missing drizzle-orm entry
- ✅ Remove or fix the missing check-health.js script reference
- ✅ Ensure workflow can complete successfully
SYSTEMIC REPAIR (Option B):
- ✅ Add proper error handling to health check workflow
- ✅ Make health check script reference optional/conditional
- ✅ Add fallback mechanisms for health status reporting
- ✅ Prevent future lockfile corruption
PREVENTIVE MEASURES:
- ✅ Add workflow validation step before health check execution
- ✅ Implement graceful degradation for missing scripts
- ✅ Add lockfile integrity checks
- ✅ Document health check system architecture

🔧 REQUIRED CHANGES

File 1: pnpm-lock.yaml

Action: Regenerate lockfile with proper dependency resolution

Method:

# Remove corrupted lockfile
rm pnpm-lock.yaml

# Clean install to regenerate
pnpm install --no-frozen-lockfile

# Verify installation
pnpm install --frozen-lockfile

Expected Result:

Valid lockfile with all dependency entries
drizzle-orm@0.29.5 properly resolved with peer dependencies
CI installation succeeds

File 2: .github/workflows/dependency-health.yml

Current (BROKEN):

- name: Set workflow status
  if: always()
  run: |
    node scripts/health/check-health.js health-report.json

Fixed (RESILIENT):

- name: Set workflow status
  if: always()
  run: |
    # Validate health report exists and contains valid data
    if [ -f health-report.json ]; then
      echo "Health report found. Validating..."
      if node -e "const data = JSON.parse(require('fs').readFileSync('health-report.json', 'utf8')); process.exit(data.status === 'healthy' ? 0 : 1);" 2>/dev/null; then
        echo "✅ Health check PASSED"
        exit 0
      else
        echo "⚠️ Health check FAILED or status unhealthy"
        exit 1
      fi
    else
      echo "⚠️ Health report not generated"
      exit 1
    fi

Why This Fix Works:

✅ Removes dependency on non-existent scripts/health/check-health.js
✅ Uses inline Node.js validation with proper error handling
✅ Validates JSON structure before parsing
✅ Provides clear error messages
✅ Exits with proper status codes for CI

File 3: scripts/health/check-health.js (NEW - Optional)

If the script was intended to exist, create it:

#!/usr/bin/env node

const fs = require('fs');
const path = require('path');

/**
 * Health Check Validator
 * Validates health-report.json and sets appropriate exit code
 */

const reportPath = process.argv[2] || 'health-report.json';

if (!fs.existsSync(reportPath)) {
  console.error('❌ Health report not found:', reportPath);
  process.exit(1);
}

try {
  const report = JSON.parse(fs.readFileSync(reportPath, 'utf8'));
  
  console.log('📊 Health Check Report:');
  console.log('  Status:', report.status);
  console.log('  Checks Passed:', report.checks_passed);
  console.log('  Checks Failed:', report.checks_failed);
  console.log(...

</details>



<!-- START COPILOT CODING AGENT SUFFIX -->

*This pull request was created from Copilot chat.*
>

<!-- START COPILOT CODING AGENT TIPS -->
---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more [Copilot coding agent tips](https://gh.io/copilot-coding-agent-tips) in the docs.

Co-authored-by: SMSDAO <144380926+SMSDAO@users.noreply.github.com>

github-actions · 2026-01-28T13:31:22Z

🏥 Dependency Health Check

Status: ⚠️ unhealthy
Checks Passed: 8
Checks Failed: 2
Version Consistency: ❌ Inconsistent

📊 Smart Brain Oracle Analysis


�[0;36m═══�[0m �[0;35mSmart Brain Oracle - Full Analysis�[0m �[0;36m═══�[0m


�[0;36m═══�[0m �[0;35mDependency Health Analysis�[0m �[0;36m═══�[0m

�[0;34m[ORACLE]�[0m Checking for outdated packages...
�[1;33m[ORACLE]�[0m Found 3 outdated packages
�[0;34m[ORACLE]�[0m Checking version consistency...
�[1;33m[ORACLE]�[0m Version inconsistencies detected

�[0;36m╔════════════════════════════════════════╗�[0m
�[0;36m║�[0m      Dependency Health Score        �[0;36m║�[0m
�[0;36m╠════════════════════════════════════════╣�[0m
�[0;36m║�[0m  Score: �[0;35m50�[0m/100                     �[0;36m║�[0m
�[0;36m║�[0m  Issues: �[1;33m4�[0m                          �[0;36m║�[0m
�[0;36m╚════════════════════════════════════════╝�[0m
�[0;31m✗ Needs attention�[0m

�[0;36m═══�[0m �[0;35mSecurity Vulnerability Scan�[0m �[0;36m═══�[0m

�[0;34m[ORACLE]�[0m Running pnpm audit...
�[1;33m[ORACLE]�[0m Vulnerabilities detected. See /home/runner/work/castquest-frames/castquest-frames/.smartbrain/cache/audit.json for details

Severity Breakdown:
  �[0;31mCritical:�[0m 2
  �[1;33mHigh:�[0m 9
  �[0;34mModerate:�[0m 13
�[0;34m[ORACLE]�[0m Checking for deprecated packages...
�[0;32m[ORACLE]�[0m No deprecated packages detected

�[0;36m═══�[0m �[0;35mPerformance Optimization Analysis�[0m �[0;36m═══�[0m

�[0;34m[ORACLE]�[0m Analyzing bundle sizes...
�[0;34m[ORACLE]�[0m Total node_modules size: 2.0G
�[0;34m[ORACLE]�[0m Detecting unused dependencies...
�[0;34m[ORACLE]�[0m Checking admin for unused dependencies...
�[0;34m[ORACLE]�[0m Checking web for unused dependencies...
�[0;34m[ORACLE]�[0m Checking mobile for unused dependencies...
�[0;34m[ORACLE]�[0m Checking docs-site for unused dependencies...
�[0;34m[ORACLE]�[0m Checking castquest-frames for unused dependencies...
�[0;34m[ORACLE]�[0m Checking frames for unused dependencies...
�[0;34m[ORACLE]�[0m Checking core-services for unused dependencies...
�[0;34m[ORACLE]�[0m Checking contracts for unused dependencies...
�[0;34m[ORACLE]�[0m Checking neo-ux-core f

ℹ️ Health Report Details

{
  "status": "unhealthy",
  "checks_passed": 8,
  "checks_failed": 2,
  "timestamp": "2026-01-28T13:30:50Z"
}

⚠️ Action Required: Please address the issues above before merging.

Copilot

Pull request overview

Fixes CI failures caused by a corrupted pnpm-lock.yaml and reduces the chance of dependency/health-check tooling emitting non-JSON output into health-report.json.

Changes:

Regenerated pnpm-lock.yaml to restore missing dependency resolution entries (and refresh transitive versions).
Redirected pnpm install output to stderr in scripts/master.sh to avoid polluting health --json output.
Added a post-regeneration pnpm install --frozen-lockfile validation step in scripts/repair-dependencies.sh.

Reviewed changes

Copilot reviewed 3 out of 5 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
scripts/repair-dependencies.sh	Adds lockfile integrity validation after regenerating lockfile.
scripts/master.sh	Redirects pnpm install stdout to stderr to keep JSON health output clean.
pnpm-lock.yaml	Regenerated lockfile to fix missing dependency entries and update resolutions.
.gitignore	Ignores generated `health-report.json`.
.github/workflows/dependency-health.yml	Adds inline troubleshooting notes for lockfile failures and clarifies final status step intent.

Copilot · 2026-01-30T10:55:23Z

scripts/repair-dependencies.sh

    ISSUES_FIXED=$((ISSUES_FIXED + 1))
+
+    # Validate lockfile integrity
+    log_info "Validating regenerated lockfile..."
+    if pnpm install --frozen-lockfile 2>&1; then
+      log_success "Lockfile is valid and consistent"


In clean_install, ISSUES_FIXED is incremented immediately after the non-frozen pnpm install, but the new lockfile validation can still fail and return 1. This can report a fix even though the lockfile was not successfully validated. Consider moving the ISSUES_FIXED increment to after the pnpm install --frozen-lockfile validation succeeds (or decrementing on validation failure).

Suggested change

ISSUES_FIXED=$((ISSUES_FIXED + 1))

# Validate lockfile integrity

log_info "Validating regenerated lockfile..."

if pnpm install --frozen-lockfile 2>&1; then

log_success "Lockfile is valid and consistent"

# Validate lockfile integrity

log_info "Validating regenerated lockfile..."

if pnpm install --frozen-lockfile 2>&1; then

log_success "Lockfile is valid and consistent"

ISSUES_FIXED=$((ISSUES_FIXED + 1))

Copilot · 2026-01-30T10:55:23Z

scripts/master.sh

    if [[ -f "$ROOT_DIR/pnpm-lock.yaml" ]]; then
-      $PNPM install --frozen-lockfile || $PNPM install || true
+      $PNPM install --frozen-lockfile >&2 || $PNPM install >&2 || true
    else
-      $PNPM install || true
+      $PNPM install >&2 || true


Redirecting pnpm output to stderr helps keep health --json output clean, but cmd_health still writes some diagnostics directly to stdout (e.g. echo "$broken_links" when broken symlinks are found at scripts/master.sh:285). When bash scripts/master.sh health --json > health-report.json is used, any non-JSON stdout will corrupt the JSON. Consider sending all non-JSON diagnostics to stderr (or suppressing them) so stdout is exclusively the JSON document.

Initial plan

a5a7660

Copilot AI assigned Copilot and SMSDAO Jan 25, 2026

Copilot started work on behalf of SMSDAO January 25, 2026 03:36 View session

Copilot AI and others added 3 commits January 25, 2026 03:43

Fix corrupted pnpm-lock.yaml and improve health check JSON generation

42498c6

Co-authored-by: SMSDAO <144380926+SMSDAO@users.noreply.github.com>

Remove accidentally committed health-report.json

cadc349

Co-authored-by: SMSDAO <144380926+SMSDAO@users.noreply.github.com>

Add workflow documentation and lockfile validation to repair script

ef51aab

Co-authored-by: SMSDAO <144380926+SMSDAO@users.noreply.github.com>

Copilot AI changed the title ~~[WIP] Fix corrupted pnpm-lock.yaml issue~~ Fix corrupted pnpm-lock.yaml and clean health check JSON output Jan 25, 2026

Copilot AI requested a review from SMSDAO January 25, 2026 03:50

Copilot finished work on behalf of SMSDAO January 25, 2026 03:50

SMSDAO approved these changes Jan 28, 2026

View reviewed changes

SMSDAO marked this pull request as ready for review January 30, 2026 10:47

Copilot AI review requested due to automatic review settings January 30, 2026 10:47

SMSDAO merged commit d5822d1 into main Jan 30, 2026
6 of 8 checks passed

Copilot started reviewing on behalf of SMSDAO January 30, 2026 10:47 View session

Copilot AI reviewed Jan 30, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Fix corrupted pnpm-lock.yaml and clean health check JSON output#79

Fix corrupted pnpm-lock.yaml and clean health check JSON output#79
SMSDAO merged 4 commits intomainfrom
copilot/fix-corrupted-lockfile

Copilot AI commented Jan 25, 2026 •

edited

Loading

Uh oh!

github-actions bot commented Jan 28, 2026

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Jan 30, 2026

Uh oh!

Copilot AI Jan 30, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

Copilot AI commented Jan 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

Result

🏥 SURGICAL DIRECTIVE: EMERGENCY INTERVENTION

🔴 CRITICAL ISSUE

📋 ROOT CAUSE ANALYSIS

Problem 1: Corrupted pnpm-lock.yaml

Problem 2: Missing Health Check Script

🎯 SURGICAL OBJECTIVES

Primary Objectives (Option A + B Combined)

🔧 REQUIRED CHANGES

File 1: pnpm-lock.yaml

File 2: .github/workflows/dependency-health.yml

File 3: scripts/health/check-health.js (NEW - Optional)

Uh oh!

github-actions bot commented Jan 28, 2026

🏥 Dependency Health Check

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Jan 30, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 30, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Copilot AI commented Jan 25, 2026 •

edited

Loading