[rush] Pass --frozen-lockfile to rush install

apps/rush-lib/assets/rush-init/common/config/rush/experiments.json

@@ -14,6 +14,12 @@
     */
   /*[LINE "HYPOTHETICAL"]*/ "legacyIncrementalBuildDependencyDetection": true,
 
+  /**
+    * By default, rush passes --no-prefer-frozen-lockfile to 'pnpm install'.
+    * Set this option to true to pass '--frozen-lockfile' instead.
+    */
+  /*[LINE "HYPOTHETICAL"]*/ "usePnpmFrozenLockfileForRushInstall": true,
+
   /**
     * If true, the chmod field in temporary project tar headers will not be normalized.
     * This normalization can help ensure consistent tarball integrity across platforms.

apps/rush-lib/src/api/ExperimentsConfiguration.ts

@@ -20,6 +20,12 @@ export interface IExperimentsJson {
    */
   legacyIncrementalBuildDependencyDetection?: boolean;
 
+  /**
+   * By default, rush passes --no-prefer-frozen-lockfile to 'pnpm install'.
+   * Set this option to true to pass '--frozen-lockfile' instead.
+   */
+  usePnpmFrozenLockfileForRushInstall?: boolean;
+
   /**
    * If true, the chmod field in temporary project tar headers will not be normalized.
    * This normalization can help ensure consistent tarball integrity across platforms.

apps/rush-lib/src/logic/InstallManager.ts

@@ -682,8 +682,17 @@ export class InstallManager {
         // We will NOT locally link this package; add it as a regular dependency.
         tempPackageJson.dependencies![packageName] = packageVersion;
 
+        let tryReusingPackageVersionsFromShrinkwrap: boolean = true;
+
+        if (this._rushConfiguration.packageManager === 'pnpm') {
+          // Shrinkwrap churn optimization doesn't make sense when --frozen-lockfile is true
+          tryReusingPackageVersionsFromShrinkwrap =
+            !this._rushConfiguration.experimentsConfiguration.configuration.usePnpmFrozenLockfileForRushInstall;
+        }
+
         if (shrinkwrapFile) {
-          if (!shrinkwrapFile.tryEnsureCompatibleDependency(dependencySpecifier, rushProject.tempProjectName)) {
+          if (!shrinkwrapFile.tryEnsureCompatibleDependency(dependencySpecifier, rushProject.tempProjectName,
+            tryReusingPackageVersionsFromShrinkwrap)) {
             shrinkwrapWarnings.push(`"${packageName}" (${packageVersion}) required by`
               + ` "${rushProject.packageName}"`);
             shrinkwrapIsUpToDate = false;
@@ -823,7 +832,7 @@ export class InstallManager {
   }
 
   /**
-   * Runs "npm install" in the common folder.
+   * Runs "npm/pnpm/yarn install" in the "common/temp" folder.
    */
   private _installCommonModules(options: {
     shrinkwrapIsUpToDate: boolean;
@@ -834,6 +843,8 @@ export class InstallManager {
       variantIsUpToDate
     } = options;
 
+    const usePnpmFrozenLockfile: boolean = this._rushConfiguration.packageManager === 'pnpm' &&
+      this._rushConfiguration.experimentsConfiguration.configuration.usePnpmFrozenLockfileForRushInstall === true;
     return Promise.resolve().then(() => {
       console.log(os.EOL + colors.bold('Checking node_modules in ' + this._rushConfiguration.commonTempFolder)
         + os.EOL);
@@ -861,7 +872,7 @@ export class InstallManager {
         // then we can't skip this install
         potentiallyChangedFiles.push(this._rushConfiguration.getCommittedShrinkwrapFilename(options.variant));
 
-        // Add common-versions.json file in potentially changed file list.
+        // Add common-versions.json file to the potentially changed files list.
         potentiallyChangedFiles.push(this._rushConfiguration.getCommonVersionsFilePath(options.variant));
 
         if (this._rushConfiguration.packageManager === 'pnpm') {
@@ -1070,7 +1081,7 @@ export class InstallManager {
             this._fixupNpm5Regression();
           }
 
-          if (options.allowShrinkwrapUpdates && !shrinkwrapIsUpToDate) {
+          if (options.allowShrinkwrapUpdates && (usePnpmFrozenLockfile || !shrinkwrapIsUpToDate)) {
             // Shrinkwrap files may need to be post processed after install, so load and save it
             const tempShrinkwrapFile: BaseShrinkwrapFile | undefined = ShrinkwrapFileFactory.getShrinkwrapFile(
               this._rushConfiguration.packageManager,
@@ -1300,13 +1311,21 @@ export class InstallManager {
       // last install flag, which encapsulates the entire installation
       args.push('--no-lock');
 
-      // Ensure that Rush's tarball dependencies get synchronized properly with the pnpm-lock.yaml file.
-      // See this GitHub issue: https://github.com/pnpm/pnpm/issues/1342
-
-      if (semver.gte(this._rushConfiguration.packageManagerToolVersion, '3.0.0')) {
-        args.push('--no-prefer-frozen-lockfile');
+      if (this._rushConfiguration.experimentsConfiguration.configuration.usePnpmFrozenLockfileForRushInstall &&
+        !this._options.allowShrinkwrapUpdates) {
+        if (semver.gte(this._rushConfiguration.packageManagerToolVersion, '3.0.0')) {
+          args.push('--frozen-lockfile');
+        } else {
+          args.push('--frozen-shrinkwrap');
+        }
       } else {
-        args.push('--no-prefer-frozen-shrinkwrap');
+        // Ensure that Rush's tarball dependencies get synchronized properly with the pnpm-lock.yaml file.
+        // See this GitHub issue: https://github.com/pnpm/pnpm/issues/1342
+        if (semver.gte(this._rushConfiguration.packageManagerToolVersion, '3.0.0')) {
+          args.push('--no-prefer-frozen-lockfile');
+        } else {
+          args.push('--no-prefer-frozen-shrinkwrap');
+        }
       }
 
       if (options.collectLogFile) {

apps/rush-lib/src/logic/base/BaseShrinkwrapFile.ts

@@ -85,9 +85,10 @@ export abstract class BaseShrinkwrapFile {
    *
    * @virtual
    */
-  public tryEnsureCompatibleDependency(dependencySpecifier: DependencySpecifier, tempProjectName: string): boolean {
+  public tryEnsureCompatibleDependency(dependencySpecifier: DependencySpecifier,
+    tempProjectName: string, tryReusingPackageVersionsFromShrinkwrap: boolean = true): boolean {
     const shrinkwrapDependency: DependencySpecifier | undefined =
-      this.tryEnsureDependencyVersion(dependencySpecifier, tempProjectName);
+      this.tryEnsureDependencyVersion(dependencySpecifier, tempProjectName, tryReusingPackageVersionsFromShrinkwrap);
     if (!shrinkwrapDependency) {
       return false;
     }
@@ -105,15 +106,15 @@ export abstract class BaseShrinkwrapFile {
 
   /** @virtual */
   protected abstract tryEnsureDependencyVersion(dependencySpecifier: DependencySpecifier,
-    tempProjectName: string): DependencySpecifier | undefined;
+    tempProjectName: string, tryReusingPackageVersionsFromShrinkwrap: boolean): DependencySpecifier | undefined;
 
   /** @virtual */
   protected abstract getTopLevelDependencyVersion(dependencyName: string): DependencySpecifier | undefined;
 
   /** @virtual */
   protected abstract serialize(): string;
 
-  protected _getTempProjectNames(dependencies: { [key: string]: {} } ): ReadonlyArray<string> {
+  protected _getTempProjectNames(dependencies: { [key: string]: {} }): ReadonlyArray<string> {
     const result: string[] = [];
     for (const key of Object.keys(dependencies)) {
       // If it starts with @rush-temp, then include it:

apps/rush-lib/src/logic/pnpm/PnpmShrinkwrapFile.ts

@@ -417,12 +417,12 @@ export class PnpmShrinkwrapFile extends BaseShrinkwrapFile {
   /**
    * Gets the resolved version number of a dependency for a specific temp project.
    * For PNPM, we can reuse the version that another project is using.
-   * Note that this function modifies the shrinkwrap data.
+   * Note that this function modifies the shrinkwrap data if tryReusingPackageVersionsFromShrinkwrap is set to true.
    *
    * @override
    */
   protected tryEnsureDependencyVersion(dependencySpecifier: DependencySpecifier,
-    tempProjectName: string): DependencySpecifier | undefined {
+    tempProjectName: string, tryReusingPackageVersionsFromShrinkwrap: boolean): DependencySpecifier | undefined {
 
     // PNPM doesn't have the same advantage of NPM, where we can skip generate as long as the
     // shrinkwrap file puts our dependency in either the top of the node_modules folder
@@ -446,7 +446,8 @@ export class PnpmShrinkwrapFile extends BaseShrinkwrapFile {
     }
 
     if (!packageDescription.dependencies.hasOwnProperty(packageName)) {
-      if (dependencySpecifier.versionSpecifier) {
+
+      if (tryReusingPackageVersionsFromShrinkwrap && dependencySpecifier.versionSpecifier) {
         // this means the current temp project doesn't provide this dependency,
         // however, we may be able to use a different version. we prefer the latest version
         let latestVersion: string | undefined = undefined;

apps/rush-lib/src/schemas/experiments.schema.json

@@ -14,7 +14,10 @@
       "description": "Rush 5.14.0 improved incremental builds to ignore spurious changes in the pnpm-lock.json file. This optimization is enabled by default. If you encounter a problem where \"rush build\" is neglecting to build some projects, please open a GitHub issue. As a workaround you can uncomment this line to temporarily restore the old behavior where everything must be rebuilt whenever pnpm-lock.json is modified.",
       "type": "boolean"
     },
-
+    "usePnpmFrozenLockfileForRushInstall": {
+      "description": "By default, rush passes --no-prefer-frozen-lockfile to 'pnpm install'. Set this option to true to pass '--frozen-lockfile' instead.",
+      "type": "boolean"
+    },
     "noChmodFieldInTarHeaderNormalization": {
       "description": "If true, the chmod field in temporary project tar headers will not be normalized. This normalization can help ensure consistent tarball integrity across platforms.",
       "type": "boolean"

common/changes/@microsoft/rush/sachinjoseph-pnpmFrozenLockfile_2020-04-29-06-04.json

@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@microsoft/rush",
+      "comment": "Provide an option to pass --frozen-lockfile to pnpm for rush install",
+      "type": "none"
+    }
+  ],
+  "packageName": "@microsoft/rush",
+  "email": "[email protected]"
+}

common/reviews/api/rush-lib.api.md

@@ -135,6 +135,7 @@ export interface IConfigurationEnvironmentVariable {
 export interface IExperimentsJson {
     legacyIncrementalBuildDependencyDetection?: boolean;
     noChmodFieldInTarHeaderNormalization?: boolean;
+    usePnpmFrozenLockfileForRushInstall?: boolean;
 }
 
 // @public