fix(release): regenerate and stage both template lockfiles on publish

[atilafassina]

What

The app template is pnpm-first and ships both template/package-lock.json and template/pnpm-lock.yaml (since #593), but the release-publish sites only refreshed the npm lock. The published template-vX.X.X tag therefore shipped a pnpm-lock.yaml pinned to the previous appkit version. Because scaffolded apps default to pnpm, they then fail pnpm install --frozen-lockfile (ERR_PNPM_OUTDATED_LOCKFILE) or silently re-resolve to an untested tree.

This completes the "two-headed lock regeneration (CI/release)" item from the pnpm-first template work at the two release-publish sites #593 left on the npm-only path.

How the template uses two lockfiles

This is one template that carries both lockfiles as two package-manager variants — not two separate templates. At databricks apps init (and in selectSmokePackageManager), the chosen PM's files are kept and the other's are deleted:

• pnpm selected → keep pnpm-lock.yaml + pnpm-workspace.yaml + .npmrc, delete package-lock.json
• npm selected → keep package-lock.json, delete pnpm-lock.yaml + pnpm-workspace.yaml + .npmrc (and set packageManager: npm@…)

So the scaffolded app a user ends up with has exactly one lockfile matching their chosen PM. detectPackageManager checks pnpm-lock.yaml before package-lock.json, which is why the non-chosen lock must be removed. Because either lock can be the one selected, both must be version-correct in what we publish — which is exactly why this fix regenerates and validates both, not just the npm one.

Changes

• tools/publish-template-tag.ts
  • Share the registry-propagation retry between the npm and pnpm installs.
  • Add pnpm install --lockfile-only --no-frozen-lockfile to regenerate template/pnpm-lock.yaml against the bumped versions (--no-frozen-lockfile required because pnpm defaults to frozen under CI; --lockfile-only skips rebuilding node_modules).
  • Add a pnpm preflight that fails loud if pnpm is unavailable — never silently skips the pnpm lock.
  • Stage template/pnpm-lock.yaml alongside the npm lock.
• .github/workflows/prepare-release.yml
  • Regenerate both locks in the template artifact step, mirroring ci.yml's existing dual-regen.
  • Rewrite both locks back to public npm (fail-closed, mirroring ci.yml), since the artifact job installs under the JFrog .npmrc. This also fixes a pre-existing leak: package-lock.json has resolved against JFrog in this artifact since the job was added in feat: add template artifact to prepare-release pipeline #263.

No changes needed in the secure release repo — it already provisions pnpm and installs from public npm.

Testing

• pnpm check, pnpm -r typecheck, pnpm test all green (5361 passed).

Follow-up

A stacked PR adds the recurrence guard: a version-parity verifier that aborts the release and fails PR CI if a template lockfile doesn't resolve the released version.

This pull request and its description were written by Isaac.

[Copilot]

Copilot review overview

🟡 Changes recommended

The release artifact can embed private JFrog URLs in the regenerated lockfiles.

Review effort: Balanced
Findings: 1

Open (1)

• Rewrite JFrog URLs in pnpm lockfile before packaging · New

What changed in this PR

Regenerates both template lockfiles during release publishing to keep pnpm-first scaffolds synchronized.

Changes:

• Adds retryable npm/pnpm lockfile regeneration and staging.
• Regenerates both locks in the release artifact workflow.

File	Description
tools/​publish-template-tag.ts	Regenerates and stages both lockfiles.
.github/​workflows/​prepare-release.yml	Adds pnpm lockfile regeneration.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

🤖 AppKit PR bot

🔬 Run evals

Start an eval for this PR from the evals-monitor app: Go to Evals Monitor →

📦 Try this PR's app template

Scaffolds a new app from this PR's SDK build. Run it in any folder (requires the GitHub CLI — gh auth login — and the Databricks CLI):

gh run download 37030059932 -R databricks/appkit -n appkit-template-0.82.0-pr.875dabd-template-publish-626 -D appkit-pr-626 \
  && unzip -o "appkit-pr-626/appkit-template-0.82.0-pr.875dabd-template-publish-626.zip" -d "appkit-pr-626" \
  && databricks apps init --template "appkit-pr-626"

The template pins @databricks/appkit and @databricks/appkit-ui to tarballs built from this branch, so the scaffolded app runs against this PR's code.

[pkosiec]

Just pls trim the comments 👍