--lockfile-only overrides --frozen-lockfile

[35ujq435jq45]

pnpm version: 7.26.1

Code to reproduce the issue: pnpm install --frozen-lockfile --lockfile-only

Expected behavior: Lockfile is frozen and won't get modified.

Actual behavior: Lockfile is updated.

Additional information:

We want to verify our lockfile. That should include linting and verifying it against all package.json files in our repository. Since pnpm doesn't provide a --dry-run/--simulate option, we have to run pnpm install --frozen-lockfile. However, this will install all dependencies which we don't need/want. Hence, we added the --lockfile-only flag. However, it seems that this flag overrides the --frozen-lockfile flag which is undocumented behavior:

$ git status
...
nothing to commit, working tree clean

$ pnpm install --frozen-lockfile --lockfile-only
...

$ git status
...
    modified:   pnpm-lock.yaml

• node -v prints: v16.15.0
• Windows, macOS, or Linux?: Ubuntu 20.04.5 LTS

[35ujq435jq45]

One easy fix would be to update the --help message and documentation for --lockfile-only and --frozen-lockfile.

[zkochan]

How would you do this with npm or Yarn?

[35ujq435jq45]

@zkochan There's yarn check: link

npm directly uses package.json if I see correctly (src).

[35ujq435jq45]

One workaround we want to try out is using the 'afterAllResolved' hook in .pnpmfile.cjs to kill pnpm.

[zkochan]

I think we can add something like pnpm install --check or pnpm check

[35ujq435jq45]

That would be awesome. I think all we need to do for this is to exit after the resolution step (afterAllResolved).

[SinimaWath]

+1 Would be usefull