ci: make yarn install --immutable explicit in CI workflows

[dev-hari-prasad]

Part of #10363.

Yarn's enableImmutableInstalls setting already defaults to true when CI is present in the environment (such as in GitHub Actions). Passing --immutable explicitly in CI workflows keeps this enforcement self-documenting and transparent.

Additionally, this adds --immutable to build and packaging scripts outside CI (Makefile, Dockerfile, and packaging build scripts for pip, Linux, and macOS) so release and local build processes fail loudly if yarn.lock would be modified instead of silently rewriting it.

Changes

• Added --immutable to yarn install in GitHub Actions workflows:
  • .github/workflows/check-javascript-style.yml
  • .github/workflows/run-javascript-tests.yml
  • .github/workflows/run-feature-tests-epas.yml
  • .github/workflows/run-feature-tests-pg.yml
• Added --immutable to yarn install in build and packaging scripts:
  • Makefile
  • Dockerfile
  • pkg/pip/build.sh
  • pkg/linux/build-functions.sh
  • pkg/mac/build-functions.sh

Summary by CodeRabbit

• Chores
  • Updated dependency installation across automated checks, application builds, and packaging processes to consistently honor the committed lockfile.
  • Builds, style checks, and JavaScript tests now fail when dependency definitions and the lockfile are out of sync, helping prevent unplanned dependency changes.
  • Improved consistency and reproducibility across supported build environments.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: 607c2bcf-6f7a-4550-97b8-908d7bbb5009

📥 Commits

Reviewing files that changed from the base of the PR and between 8899d2e and 2ecb4a4.

📒 Files selected for processing (5)

• Dockerfile
• Makefile
• pkg/linux/build-functions.sh
• pkg/mac/build-functions.sh
• pkg/pip/build.sh

Included review availability: Your plan provides up to 8 included reviews per hour; 7 remain after this review.

---

Walkthrough

Yarn installation commands in four workflows, the Docker build, the Makefile, and Linux, macOS, and pip build scripts now use yarn install --immutable. These commands fail when the lockfile and package manifest are inconsistent.

Changes

CI install consistency

Layer / File(s)	Summary
Enforce immutable Yarn installs .github/workflows/check-javascript-style.yml, .github/workflows/run-feature-tests-epas.yml, .github/workflows/run-feature-tests-pg.yml, .github/workflows/run-javascript-tests.yml	The workflow install steps now use yarn install --immutable and fail when installation would modify the lockfile.
Enforce immutable Yarn installs in builds Dockerfile, Makefile, pkg/linux/build-functions.sh, pkg/mac/build-functions.sh, pkg/pip/build.sh	The Docker, local, Linux, macOS, and pip build install steps now use yarn install --immutable.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Suggested reviewers: asheshv, dpage

Merge Risk: ⚪ Minimal · up to 2ecb4

CI and build/package installs now reject lockfile drift instead of rewriting dependencies. The focused edits introduce no unresolved merge-blocking risk.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 2 functions across 3 files. (2 skipped: 2 …	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately describes the change to make yarn install --immutable explicit in CI workflows. It omits the additional Makefile, Docker, and packaging changes, but it remains related to a prim…

Full details: Docstring Coverage

Explanation

Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 2 functions across 3 files. (2 skipped: 2 unsupported.)

• Fix all pre-merge checks with AI

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[dpage]

I would like to take this, but widened a little first.

On the four workflows the flag is documentation only, since enableImmutableInstalls is already true whenever CI is set, and the CI logs show Yarn additionally enabling hardened mode on public pull requests. That is fine and worth keeping for exactly the reason you gave, but the places where --immutable actually changes behaviour are the five installs that can run outside CI:

• Makefile:28
• Dockerfile:45
• pkg/pip/build.sh:65
• pkg/linux/build-functions.sh:307
• pkg/mac/build-functions.sh:311

All five run with yarn.lock beside them, including the Docker build, which copies web/ wholesale, and the yarn set version call that precedes three of them only rewrites .yarnrc.yml and the packageManager field, so it cannot trip the flag. A release build that quietly rewrites the lockfile is shipping something other than what we reviewed, so failing loudly there is the point of the exercise.

Add those five to what you already have and I will merge it. The other four PRs in the series are merged, and I have closed #10392 with an explanation.

[dev-hari-prasad]

The requested changes are in place exactly as you asked for them. We can merge this and close #10363.