fix(build): allow esbuild install scripts

[ismet]

Status

LGTM. Merge-ready after the current approval is recorded.

What was wrong

Source builds with pnpm 10/11 could reject esbuild's required install script. The original fix only worked with allowBuilds-aware pnpm versions (10.26+), left pnpm 11 unable to reproduce the lockfile's security overrides, and made pnpm --dir website install resolve to the root workspace instead of the website's independent lockfile.

How it was fixed

• Approves only the locked esbuild@0.28.1 release for pnpm 10.26+/11.
• Keeps the legacy package-level esbuild approval for pnpm 9 and pnpm 10.0-10.25.
• Mirrors root and website security overrides into the workspace location required by pnpm 11.
• Gives website/ its own workspace boundary so its package graph and lockfile remain independent.
• Includes the root workspace policy in the Nix source and validation paths.
• Adds regression tests that fail if build approvals, locked esbuild versions, security overrides, or workspace boundaries drift.

Replication / proof

Before hardening:

• Strict pnpm 10.25 failed with ERR_PNPM_IGNORED_BUILDS.
• pnpm 11.5.2 frozen root installs failed with ERR_PNPM_LOCKFILE_CONFIG_MISMATCH.
• pnpm --dir website install installed the 287-package root graph instead of the 373-package website graph.

After hardening:

• Clean root and website installs pass with pnpm 9.15.9, strict pnpm 10.25, pnpm 10.26+, and pnpm 11.5.2 without changing either lockfile.
• Local build, type-check, lint, and all 3,665 tests pass.
• Hosted Linux, macOS, Windows, Nix, audit, dependency review, website lockfile, release tracking, and automated review checks pass.

Notes / nits

This changes source-build policy only. It does not alter OpenSpec's runtime architecture, public API, or npm-installed package contents. The exact esbuild approval intentionally fails closed when the dependency version changes so the next upgrade must be reviewed.

Refs: #1195

[coderabbitai]

📝 Walkthrough

Walkthrough

This PR adds pnpm workspace configuration for the root and website packages. It permits esbuild builds, adds dependency overrides, updates CI and Nix file tracking, and adds configuration tests.

Changes

pnpm workspace policy

Layer / File(s)	Summary
Define workspace configuration pnpm-workspace.yaml, website/pnpm-workspace.yaml, package.json, website/package.json	The root and website configurations define workspace scope, permit esbuild builds, and set dependency overrides.
Track workspace configuration in CI and Nix .github/workflows/ci.yml, .github/workflows/security.yml, flake.nix	CI, security, and Nix processing now includes pnpm-workspace.yaml changes.
Validate workspace policy test/pnpm-workspace-config.test.ts	Tests validate workspace scope, build approvals, dependency overrides, versions, and integration references.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related issues

• pnpm install fails in CI/downstream builds: [ERR_PNPM_IGNORED_BUILDS] for esbuild #1195: Addresses the same esbuild build-approval issue in root and website workspace configuration.

Possibly related PRs

• Fission-AI/OpenSpec#518: Both changes update CI path filtering for Nix validation.
• Fission-AI/OpenSpec#1461: Both changes update brace-expansion dependency overrides.
• Fission-AI/OpenSpec#1510: This PR extends related dependency overrides across root and website configurations.

Suggested reviewers: tabishb, alfred-openspec, clay-good

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the primary change: allowing esbuild install scripts to fix pnpm build installation failures.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Adds a pnpm-workspace.yaml config intended to permit build scripts for esbuild.

Changes:

• Introduces pnpm-workspace.yaml
• Configures allowBuilds to allow esbuild builds

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[alfred-openspec]

Verified the clean-install fix in a fresh checkout with pnpm 10.32.1: \ ERR_PNPM_NO_PKG_MANIFEST  No package.json found in /Users/alfred/.openclaw/workspace now allows esbuild's postinstall and \ ERR_PNPM_RECURSIVE_EXEC_NO_PACKAGE  No package found in this workspace passes. The config is scoped to the one dependency that needs a build script and should be included in source tarballs for downstream packagers. Looks good to merge.

[coderabbitai]

Note

GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer.

[alfred-openspec]

Re-reviewed the current head in a fresh checkout with pnpm 10.32.1. The workspace root is declared, the build permission is scoped to esbuild, its postinstall runs successfully, and the build plus 31 focused tests pass. The full hosted matrix is green.

[clay-good]

LGTM. The hardening closes the pnpm 9/10/11 policy gap, preserves root and website lockfile isolation, retains security overrides across pnpm generations, and includes exact-version drift tests. Verified clean installs across supported pnpm generations, all 3,665 local tests, and the complete hosted Linux/macOS/Windows/Nix/security matrix.

[alfred-openspec]

Re-reviewed the workspace-policy hardening on the exact current head. Clean installs succeed under both the pinned pnpm 9.15.9 and pnpm 10.32.1, with esbuild 0.28.1 postinstall producing the native binary in both root and website projects. The duplicated override policies match both lockfiles, the focused policy tests and root build pass, both audits are clean, and the full hosted matrix is green.