From dce2c383872dadbcb2af1866d082d7a46b2de724 Mon Sep 17 00:00:00 2001
From: Crystal Luc-Magloire <crystal.magloire@datadoghq.com>
Date: Wed, 9 Sep 2026 14:02:19 -0400
Subject: [PATCH 1/2] fix: support installs without yarn.lock

---
 .github/workflows/build.yml  |  3 ++
 scripts/install_deps.sh      | 29 +++++++++++++------
 scripts/test_install_deps.sh | 56 ++++++++++++++++++++++++++++++++++++
 3 files changed, 79 insertions(+), 9 deletions(-)
 create mode 100755 scripts/test_install_deps.sh

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 96606877..21581b67 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -33,6 +33,9 @@ jobs:
       - name: Install dependencies
         run: ./scripts/install_deps.sh
 
+      - name: Test dependency installer without a lockfile
+        run: ./scripts/test_install_deps.sh
+
       - name: Check formatting
         run: yarn check-formatting
 
diff --git a/scripts/install_deps.sh b/scripts/install_deps.sh
index c5cba578..3a3428d8 100755
--- a/scripts/install_deps.sh
+++ b/scripts/install_deps.sh
@@ -47,19 +47,30 @@ yarn_args=("--ignore-engines")
 
 if [ -n "$dd_trace_override" ]; then
     echo "Node ${TARGET_NODE_MAJOR} is not supported by dd-trace v6, pinning dd-trace to ${dd_trace_override}"
-    # Rewrite the manifest against temporary backups and restore both tracked
-    # files on exit, however the install ends. node_modules keeps the resolved
-    # v5 line (which is what update_dist_version.sh reads), but leaving
-    # package.json/yarn.lock modified would make the next v6 build on this
-    # tree silently install the wrong tracer line against a dirty lockfile.
+    # Rewrite the manifest against a temporary backup and preserve the lockfile
+    # when the input tree contains one. Restore that initial state on exit,
+    # however the install ends. node_modules keeps the resolved v5 line (which
+    # is what update_dist_version.sh reads), but leaving package.json or a
+    # generated v5 lockfile behind could affect the next build from this tree.
     package_backup=$(mktemp)
-    lock_backup=$(mktemp)
+    lock_backup=""
     cp package.json "$package_backup"
-    cp yarn.lock "$lock_backup"
+    if [ -f yarn.lock ]; then
+        lock_backup=$(mktemp)
+        cp yarn.lock "$lock_backup"
+    fi
     restore_manifests() {
         cp "$package_backup" package.json
-        cp "$lock_backup" yarn.lock
-        rm -f "$package_backup" "$lock_backup"
+        if [ -n "$lock_backup" ]; then
+            cp "$lock_backup" yarn.lock
+            rm -f "$lock_backup"
+        else
+            # Reduced build contexts may omit the repository lockfile. Remove
+            # the v5 lockfile generated by Yarn so the temporary pin still
+            # leaves the input tree unchanged.
+            rm -f yarn.lock
+        fi
+        rm -f "$package_backup"
     }
     trap restore_manifests EXIT
     node ./scripts/set_ddtrace_version.js "$(cat package.json)" "$dd_trace_override" > package-new.json
diff --git a/scripts/test_install_deps.sh b/scripts/test_install_deps.sh
new file mode 100755
index 00000000..3a620232
--- /dev/null
+++ b/scripts/test_install_deps.sh
@@ -0,0 +1,56 @@
+#!/bin/bash
+
+# Regression test for install_deps.sh in reduced build contexts that do not
+# include the repository's yarn.lock.
+
+set -euo pipefail
+
+scripts_dir=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
+repo_dir=$(dirname "$scripts_dir")
+test_repo=$(mktemp -d)
+
+cleanup() {
+    rm -rf "$test_repo"
+}
+trap cleanup EXIT
+
+mkdir -p "$test_repo/scripts" "$test_repo/bin"
+cp "$repo_dir/package.json" "$test_repo/package.json"
+cp "$scripts_dir/dd_trace_versions.sh" "$test_repo/scripts/dd_trace_versions.sh"
+cp "$scripts_dir/install_deps.sh" "$test_repo/scripts/install_deps.sh"
+cp "$scripts_dir/set_ddtrace_version.js" "$test_repo/scripts/set_ddtrace_version.js"
+
+# Avoid a network install while preserving Yarn's relevant behavior: verify
+# the temporary v5 manifest and create the lockfile that a real install would.
+cat > "$test_repo/bin/yarn" <<'EOF'
+#!/bin/bash
+set -euo pipefail
+
+case " $* " in
+    *" --ignore-engines "*) ;;
+    *) echo "install did not pass --ignore-engines" >&2; exit 1 ;;
+esac
+case " $* " in
+    *" --frozen-lockfile "*) echo "v5 install unexpectedly froze the lockfile" >&2; exit 1 ;;
+esac
+
+expected=$(sed -n 's/^DD_TRACE_V5_VERSION="\([^"]*\)"/\1/p' scripts/dd_trace_versions.sh)
+actual=$(node -p "require('./package.json').devDependencies['dd-trace']")
+if [ "$actual" != "$expected" ]; then
+    echo "expected temporary dd-trace pin $expected, found $actual" >&2
+    exit 1
+fi
+
+touch yarn.lock
+EOF
+chmod +x "$test_repo/bin/yarn"
+
+PATH="$test_repo/bin:$PATH" TARGET_NODE_MAJOR=20 "$test_repo/scripts/install_deps.sh"
+
+cmp "$repo_dir/package.json" "$test_repo/package.json"
+if [ -e "$test_repo/yarn.lock" ]; then
+    echo "install_deps.sh left a generated yarn.lock in a lockfile-free context" >&2
+    exit 1
+fi
+
+echo "install_deps.sh supports a build context without yarn.lock"

From e6d600ce87ca59f88d5df506da9f81a6ef784d73 Mon Sep 17 00:00:00 2001
From: Crystal Luc-Magloire <crystal.magloire@datadoghq.com>
Date: Wed, 9 Sep 2026 15:18:44 -0400
Subject: [PATCH 2/2] ci: restart workflows