From e3d9759d249de9bfa8d174886aa38376ab51aaca Mon Sep 17 00:00:00 2001
From: suyx <dada20041002@163.com>
Date: Tue, 28 Jul 2026 13:17:25 +0800
Subject: [PATCH] fix: verify pinned pnpm in Windows CI

---
 .gitea/workflows/p0a-ci.yml     | 14 ++++++++++++--
 scripts/verify-ci-isolation.mjs |  3 +++
 2 files changed, 15 insertions(+), 2 deletions(-)

diff --git a/.gitea/workflows/p0a-ci.yml b/.gitea/workflows/p0a-ci.yml
index 9473ab3..0070b02 100644
--- a/.gitea/workflows/p0a-ci.yml
+++ b/.gitea/workflows/p0a-ci.yml
@@ -15,9 +15,19 @@ jobs:
     steps:
       - name: Check out frozen revision
         uses: actions/checkout@v4
-      - name: Enable frozen package manager
+      - name: Verify frozen package manager
         shell: powershell
-        run: corepack enable
+        run: |
+          $ErrorActionPreference = "Stop"
+          $expectedPackageManager = (Get-Content package.json -Raw | ConvertFrom-Json).packageManager
+          if ($expectedPackageManager -notmatch '^pnpm@(?<version>.+)$') {
+            throw "package.json must pin pnpm with packageManager"
+          }
+          $expectedVersion = $Matches.version
+          $actualVersion = (pnpm --version).Trim()
+          if ($actualVersion -ne $expectedVersion) {
+            throw "Expected pnpm $expectedVersion, got $actualVersion"
+          }
       - name: Install frozen dependencies
         shell: powershell
         run: pnpm install --frozen-lockfile
diff --git a/scripts/verify-ci-isolation.mjs b/scripts/verify-ci-isolation.mjs
index 2c3a7f2..c86e7a3 100644
--- a/scripts/verify-ci-isolation.mjs
+++ b/scripts/verify-ci-isolation.mjs
@@ -5,6 +5,9 @@ const policy = JSON.parse(readFileSync("ci/runner-isolation-policy.json", "utf8"
 const workflow = readFileSync(".gitea/workflows/p0a-ci.yml", "utf8");
 
 for (const label of policy.required_labels) assert.match(workflow, new RegExp(`\\b${label}\\b`));
+assert.doesNotMatch(workflow, /\bcorepack enable\b/);
+assert.match(workflow, /Get-Content package\.json -Raw \| ConvertFrom-Json/);
+assert.match(workflow, /pnpm --version/);
 assert.match(workflow, /pnpm install --frozen-lockfile/);
 assert.match(workflow, /DADA_EXTERNAL_MODE:\s*mock/);
 assert.match(workflow, /pnpm test:all/);