ci(install): close Bun migration validation gaps

1. Keep the version bump at HEAD on release proposal branches by preventing license auto-commits there.
2. Keep scoped package identities slash-delimited so Windows sandbox setup patches their peers.
3. Regenerate license attribution when any source input changes instead of only on lock updates.

Author: BridgeAR

.github/workflows/update-3rdparty-licenses.yml

@@ -13,8 +13,15 @@ on:
   pull_request:
     paths:
       - ".github/vendored-dependencies.csv"
+      - ".github/workflows/update-3rdparty-licenses.yml"
+      - "LICENSE-3rdparty.csv"
       - "bun.lock"
+      - "package.json"
+      - "scripts/generate-3rdparty-licenses.js"
+      - "scripts/helpers/concurrency.js"
+      - "scripts/third-party-dependencies.js"
       - "vendor/bun.lock"
+      - "vendor/package.json"
 
 jobs:
   check-licenses:
@@ -24,6 +31,7 @@ jobs:
     outputs:
       needs_update: ${{ steps.check.outputs.needs_update }}
       is_bot_same_repo: ${{ steps.check.outputs.is_bot_same_repo }}
+      is_release_proposal: ${{ steps.check.outputs.is_release_proposal }}
       head_oid: ${{ steps.check.outputs.head_oid }}
     steps:
       - name: Check out PR branch
@@ -40,6 +48,7 @@ jobs:
           PR_USER_TYPE: ${{ github.event.pull_request.user.type }}
           PR_HEAD_REPO: ${{ github.event.pull_request.head.repo.full_name }}
           BASE_REPO: ${{ github.repository }}
+          HEAD_REF: ${{ github.head_ref }}
         run: |
           set -e
           echo "head_oid=${{ github.event.pull_request.head.sha }}" >> "$GITHUB_OUTPUT"
@@ -58,16 +67,28 @@ jobs:
             echo "is_bot_same_repo=false" >> "$GITHUB_OUTPUT"
           fi
 
+          # Release tooling requires the version bump to stay at HEAD.
+          if [[ "$HEAD_REF" =~ ^v[0-9]+\.[0-9]+\.[0-9]+-proposal$ ]]; then
+            echo "is_release_proposal=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "is_release_proposal=false" >> "$GITHUB_OUTPUT"
+          fi
+
       - name: Upload updated LICENSE-3rdparty.csv
-        if: steps.check.outputs.needs_update == 'true' && steps.check.outputs.is_bot_same_repo == 'true'
+        if: >-
+          steps.check.outputs.needs_update == 'true' &&
+          steps.check.outputs.is_bot_same_repo == 'true' &&
+          steps.check.outputs.is_release_proposal != 'true'
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: license-csv
           path: LICENSE-3rdparty.csv
           if-no-files-found: error
 
       - name: Fail for PRs with outdated licenses
-        if: steps.check.outputs.needs_update == 'true' && steps.check.outputs.is_bot_same_repo != 'true'
+        if: >-
+          steps.check.outputs.needs_update == 'true' &&
+          (steps.check.outputs.is_bot_same_repo != 'true' || steps.check.outputs.is_release_proposal == 'true')
         run: |
           echo "❌ The LICENSE-3rdparty.csv file needs to be updated!"
           echo ""
@@ -76,7 +97,10 @@ jobs:
 
   auto-commit-licenses:
     needs: check-licenses
-    if: needs.check-licenses.outputs.needs_update == 'true' && needs.check-licenses.outputs.is_bot_same_repo == 'true'
+    if: >-
+      needs.check-licenses.outputs.needs_update == 'true' &&
+      needs.check-licenses.outputs.is_bot_same_repo == 'true' &&
+      needs.check-licenses.outputs.is_release_proposal != 'true'
     runs-on: ubuntu-latest
     permissions:
       contents: read

scripts/install_plugin_modules.js

@@ -5,7 +5,7 @@ const { existsSync, mkdirSync, readdirSync, readFileSync, rmSync, writeFileSync
 const { lstat, mkdir, readdir, readFile, writeFile } = require('fs/promises')
 const { createRequire } = require('module')
 const { arch } = require('os')
-const { join } = require('path')
+const { join, posix } = require('path')
 
 // eslint-disable-next-line n/no-restricted-require
 const semver = require('semver')
@@ -357,11 +357,11 @@ async function collectPeerDependencyFolders (rootFolder, parent = '') {
     if (!isGeneratedWorkspace(entry, parent)) continue
     if (entry.startsWith('@')) {
       // eslint-disable-next-line no-await-in-loop
-      folders.push(...await collectPeerDependencyFolders(current, parent ? join(parent, entry) : entry))
+      folders.push(...await collectPeerDependencyFolders(current, posix.join(parent, entry)))
       continue
     }
 
-    const externalName = join(parent, entry.split('@', 1)[0])
+    const externalName = posix.join(parent, entry.split('@', 1)[0])
     if (externalDeps.has(externalName)) folders.push({ folder: current, externalName })
   }
 
@@ -433,7 +433,7 @@ async function patchPeerDependencies ({ folder, externalName }) {
  * @returns {boolean}
  */
 function isGeneratedWorkspace (entry, parent = '') {
-  const workspaceName = parent ? join(parent, entry) : entry
+  const workspaceName = parent ? posix.join(parent, entry) : entry
 
   if (entry.startsWith('@')) {
     for (const workspace of workspaces) {

scripts/test/install-plugin-modules.spec.js

@@ -197,6 +197,29 @@ externals.express.push(
     assert.strictEqual(semver.subset(manifest.dependencies.zod, '^4.0.0'), true)
   })
 
+  it('keeps scoped package identities portable across path separators', () => {
+    const preload = path.join(wrapperDirectory, 'windows-package-separators.js')
+    fs.writeFileSync(preload, `
+const path = require('node:path')
+const nativeJoin = path.join
+path.posix = { ...path.posix, join: nativeJoin }
+/**
+ * @param {...string} parts
+ */
+path.join = function join (...parts) {
+  return parts[0].startsWith('@') ? path.win32.join(...parts) : nativeJoin(...parts)
+}
+`)
+
+    runInstall('claude-agent-sdk', undefined, undefined, {
+      NODE_OPTIONS: `--require=${preload}`,
+    })
+
+    const manifest = require(path.join(versionsDir, '@anthropic-ai', 'claude-agent-sdk', 'package.json'))
+    assert.ok(manifest.dependencies.zod, 'expected the scoped workspace to receive its peer dependency')
+    assert.strictEqual(semver.subset(manifest.dependencies.zod, '^4.0.0'), true)
+  })
+
   it('trusts the transitive native builder required by pg-native', () => {
     runInstall('pg')
 
@@ -253,12 +276,14 @@ function readVersionsManifest () {
  * @param {string} plugin
  * @param {string} [binDirectory]
  * @param {string} [traceFile]
+ * @param {NodeJS.ProcessEnv} [env]
  * @returns {import('node:child_process').SpawnSyncReturns<string>}
  */
-function runInstall (plugin, binDirectory, traceFile) {
+function runInstall (plugin, binDirectory, traceFile, env) {
   const result = spawnInstall(plugin, {
     PATH: `${binDirectory ?? wrapperDirectory}:/usr/bin:/bin`,
     ...(traceFile && { DD_TEST_PACKAGE_MANAGER_TRACE_FILE: traceFile }),
+    ...env,
   })
 
   assert.strictEqual(

scripts/test/no-yarn-dev-references.spec.js

@@ -438,4 +438,43 @@ describe('no yarn dev references', function () {
       ]
     )
   })
+
+  it('regenerates licenses when any generator input changes', () => {
+    const workflow = yaml.parse(fs.readFileSync(
+      path.join(repoRoot, '.github/workflows/update-3rdparty-licenses.yml'),
+      'utf8'
+    ))
+
+    assert.deepStrictEqual(workflow.on.pull_request.paths.sort(), [
+      '.github/vendored-dependencies.csv',
+      '.github/workflows/update-3rdparty-licenses.yml',
+      'LICENSE-3rdparty.csv',
+      'bun.lock',
+      'package.json',
+      'scripts/generate-3rdparty-licenses.js',
+      'scripts/helpers/concurrency.js',
+      'scripts/third-party-dependencies.js',
+      'vendor/bun.lock',
+      'vendor/package.json',
+    ])
+  })
+
+  it('keeps automated license updates off release proposal branches', () => {
+    const workflow = yaml.parse(fs.readFileSync(
+      path.join(repoRoot, '.github/workflows/update-3rdparty-licenses.yml'),
+      'utf8'
+    ))
+    const checkJob = workflow.jobs['check-licenses']
+    const checkScript = checkJob.steps.find(step => step.id === 'check').run
+    const uploadStep = checkJob.steps.find(step => step.name === 'Upload updated LICENSE-3rdparty.csv')
+    const failStep = checkJob.steps.find(step => step.name === 'Fail for PRs with outdated licenses')
+
+    assert.strictEqual(checkJob.outputs.is_release_proposal, '$' + '{{ steps.check.outputs.is_release_proposal }}')
+    assert.match(checkScript, /\^v\[0-9\]\+\\\.\[0-9\]\+\\\.\[0-9\]\+-proposal\$/)
+    assert.match(checkScript, /is_release_proposal=true/)
+    assert.match(checkScript, /is_release_proposal=false/)
+    assert.match(uploadStep.if, /is_release_proposal != 'true'/)
+    assert.match(failStep.if, /is_release_proposal == 'true'/)
+    assert.match(workflow.jobs['auto-commit-licenses'].if, /is_release_proposal != 'true'/)
+  })
 })