fix: harden pnpm supply chain and runtime image (#572)

scripts/__tests__/ci-determinism.test.ts

@@ -4,6 +4,7 @@ import { afterEach, describe, expect, it, vi } from "vitest";
 import { parse } from "yaml";
 
 import integrationConfig from "../../vitest.integration.config.mts";
+import unitConfig from "../../vitest.config.mts";
 
 function repositoryRoot(): string {
   const testPath = expect.getState().testPath;
@@ -75,6 +76,12 @@ describe("Playwright CI determinism", () => {
   });
 });
 
+describe("local worktree isolation", () => {
+  it("keeps nested worktree suites out of the root unit run", () => {
+    expect(unitConfig.test?.exclude ?? []).toContain(".worktrees/**");
+  });
+});
+
 describe("integration environment isolation", () => {
   it("registers a worker setup bridge and authoritative test secrets", () => {
     const test = integrationConfig.test;
@@ -114,11 +121,11 @@ describe("container dependency installation", () => {
 
 describe("production dependency advisory floors", () => {
   it("pins vulnerable transitive ranges to compatible patched versions", () => {
-    const packageJson = JSON.parse(readRepoFile("package.json")) as {
-      pnpm?: { overrides?: Record<string, string> };
+    const workspace = parse(readRepoFile("pnpm-workspace.yaml")) as {
+      overrides?: Record<string, string>;
     };
 
-    expect(packageJson.pnpm?.overrides).toMatchObject({
+    expect(workspace.overrides).toMatchObject({
       "dompurify@<=3.4.10": "^3.4.11",
       "postcss@<8.5.10": "^8.5.10",
       "@hono/node-server@<1.19.13": "^1.19.13",

scripts/__tests__/release-workflows.test.ts

@@ -232,16 +232,28 @@ describe("release container inputs", () => {
     );
   });
 
-  it("uses the packageManager pnpm version instead of a moving tag", () => {
+  it("pins pnpm for builds and removes package managers from runtime", () => {
     const dockerfile = readRepoFile("Dockerfile");
     const packageJson = JSON.parse(readRepoFile("package.json")) as {
       packageManager: string;
     };
-    expect(packageJson.packageManager).toBe("pnpm@10.31.0");
+    expect(packageJson.packageManager).toBe("pnpm@11.15.1");
     expect(dockerfile).not.toContain("pnpm@latest");
     expect(
-      dockerfile.match(/corepack prepare pnpm@10\.31\.0 --activate/g),
-    ).toHaveLength(3);
+      dockerfile.match(/corepack prepare pnpm@11\.15\.1 --activate/g),
+    ).toHaveLength(2);
+    expect(dockerfile).toContain(
+      "rm -rf /usr/local/lib/node_modules/npm /usr/local/lib/node_modules/corepack /root/.cache/node/corepack",
+    );
+    expect(dockerfile).toContain("tsx@4.23.1");
+    expect(dockerfile).toContain(
+      "ln -sfn /opt/prisma-cli/node_modules/.bin/tsx /usr/local/bin/healthlog-tsx",
+    );
+  });
+
+  it("keeps linked worktrees out of the Docker build context", () => {
+    const dockerignore = readRepoFile(".dockerignore");
+    expect(dockerignore.split(/\r?\n/)).toContain(".worktrees");
   });
 
   it("bundles Prisma's adapter and verifies only runtime externals", () => {