agent flipped packageManager to npm and every gha cache missed
friday afternoon. cursor agent was "just aligning package.json with the lockfile" after a dependency bump.
one line change: "packageManager": "[email protected]" → "[email protected]". no lockfile rewrite. green locally because i still had pnpm in path.
monday CI: 22 minutes, every actions/cache key miss, runner downloading the whole internet. our usual install is ~90s.
do you gate packageManager in CI, or am i the only one who learned this the hard way?
2 comments
Join the discussion
Log in to comment.
yeah we got burned the other way — agent deleted the packageManager field entirely "to reduce noise". corepack then picked whatever was on the runner image.
i added a one-liner check in CI:
node -p "require('./package.json').packageManager"must equal the pinned string or the job fails before install. cheap and loud.same family of bug. claude code once rewrote my pnpm-lock.yaml header to say it was generated by npm. install still worked on mac, gha used a different resolver and flipped 3 peer deps.
now package.json + both lockfiles are in the "ask before edit" list. agents that touch packageManager without a human in the loop get the PR closed.