[humble-little-bear]

Root cause

The "Canary release on new commit" run for the v0.5.x merge (d508137, run 37732677427) failed at Install dependencies with:

Error: ERR_PNPM_IGNORED_BUILDS
  ╰─▶ Ignored build scripts: cpu-features@0.0.10, unrs-resolver@1.11.1

canary-publish.yml and publish.yml installed pnpm with an unpinned npm install -g pnpm && pnpm i (in place since #223). That installs whatever the npm latest tag points to:

• The last successful canary (2026-08-24, ee0ad6b) ran pnpm v10.34.5. pnpm 10 only warns about ignored build scripts, and the same warning appears in that log.
• pnpm 12.0.0 was released on 2026-08-26, and latest now points to 12.10.1. pnpm 11+ fails the install for any build script that is not explicitly allowed. No canary ran between 2026-08-24 and this merge, so this was the first run to use the new major.

The allowBuilds: <pkg>: set this to true or false placeholders added in #526 do not cause the failure on their own. They were written by a newer pnpm, and pnpm 12 also rejects them. I verified this in a scratch copy with pnpm@12.10.1 install --frozen-lockfile:

pnpm-workspace.yaml	pnpm 12.10.1
no allowBuilds (pre-#526)	❌ ERR_PNPM_IGNORED_BUILDS
placeholders (current develop)	❌ ERR_PNPM_IGNORED_BUILDS
false / false (this PR)	✅

Fix

1. canary-publish.yml / publish.yml: use pnpm/action-setup@v4 with version: 10 and pnpm install --frozen-lockfile, the same as test.yml, node.js.yml and changeset-check.yml. setup-node keeps registry-url, and the publish steps keep NODE_AUTH_TOKEN, so npm publish works as before.
2. pnpm-workspace.yaml: replace the placeholders with explicit values:
   • cpu-features: false. It is an optionalDependency of the CLI itself, used by src/node/install.ts to choose the portable CKB binary. That code already falls back to the portable binary when the addon cannot load. scripts/build.js keeps it --external in the ncc bundle, so end users still compile it during their own npm i -g @offckb/cli, and the false here has no effect on them. Nothing in this repo's build or tests needs the native addon. CI has never compiled it, because pnpm 10 has been ignoring it all along.
   • unrs-resolver: false. This is a jest-resolve dependency. Its postinstall only runs napi-postinstall ... check against the prebuilt @unrs/resolver-binding-* optional package, which is already installed.

With false, the behaviour stays exactly as it was under pnpm 10, and the config also works under newer pnpm. pnpm install --frozen-lockfile passes in a scratch copy with pnpm 10.34.6, 11.28.2 (Node 22) and 12.10.1.

An empty changeset is included because Verify Changeset requires one for every PR that has no label.

Checks (local, pnpm 10.33.4)

pnpm install --frozen-lockfile, typecheck, build and lint pass (lint has 1 pre-existing warning). test:ci: 534 passed and 2 failed. The 2 failures are the known isStoreLockHeld › with lsof environment failures on the dev box.

After merge

develop needs to be merged into v0.5.x again to re-trigger the canary release. The canary workflow runs on push to v0.*.x and reads its workflow file from that branch.

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 36 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 8e2b8f36-8af1-4d1f-a12e-eae651d50e4e

📥 Commits

Reviewing files that changed from the base of the PR and between 34a92c4 and e5c2aa1.

📒 Files selected for processing (4)

• .changeset/pin-pnpm-canary.md
• .github/workflows/canary-publish.yml
• .github/workflows/publish.yml
• pnpm-workspace.yaml

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}