fix: support installs without yarn.lock

.github/workflows/build.yml

@@ -33,6 +33,9 @@ jobs:
       - name: Install dependencies
         run: ./scripts/install_deps.sh
 
+      - name: Test dependency installer without a lockfile
+        run: ./scripts/test_install_deps.sh
+
       - name: Check formatting
         run: yarn check-formatting
 

scripts/install_deps.sh

@@ -47,19 +47,30 @@ yarn_args=("--ignore-engines")
 
 if [ -n "$dd_trace_override" ]; then
     echo "Node ${TARGET_NODE_MAJOR} is not supported by dd-trace v6, pinning dd-trace to ${dd_trace_override}"
-    # Rewrite the manifest against temporary backups and restore both tracked
-    # files on exit, however the install ends. node_modules keeps the resolved
-    # v5 line (which is what update_dist_version.sh reads), but leaving
-    # package.json/yarn.lock modified would make the next v6 build on this
-    # tree silently install the wrong tracer line against a dirty lockfile.
+    # Rewrite the manifest against a temporary backup and preserve the lockfile
+    # when the input tree contains one. Restore that initial state on exit,
+    # however the install ends. node_modules keeps the resolved v5 line (which
+    # is what update_dist_version.sh reads), but leaving package.json or a
+    # generated v5 lockfile behind could affect the next build from this tree.
     package_backup=$(mktemp)
-    lock_backup=$(mktemp)
+    lock_backup=""
     cp package.json "$package_backup"
-    cp yarn.lock "$lock_backup"
+    if [ -f yarn.lock ]; then
+        lock_backup=$(mktemp)
+        cp yarn.lock "$lock_backup"
+    fi
     restore_manifests() {
         cp "$package_backup" package.json
-        cp "$lock_backup" yarn.lock
-        rm -f "$package_backup" "$lock_backup"
+        if [ -n "$lock_backup" ]; then
+            cp "$lock_backup" yarn.lock
+            rm -f "$lock_backup"
+        else
+            # Reduced build contexts may omit the repository lockfile. Remove
+            # the v5 lockfile generated by Yarn so the temporary pin still
+            # leaves the input tree unchanged.
+            rm -f yarn.lock
+        fi
+        rm -f "$package_backup"
     }
     trap restore_manifests EXIT
     node ./scripts/set_ddtrace_version.js "$(cat package.json)" "$dd_trace_override" > package-new.json

scripts/test_install_deps.sh

@@ -0,0 +1,56 @@
+#!/bin/bash
+
+# Regression test for install_deps.sh in reduced build contexts that do not
+# include the repository's yarn.lock.
+
+set -euo pipefail
+
+scripts_dir=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
+repo_dir=$(dirname "$scripts_dir")
+test_repo=$(mktemp -d)
+
+cleanup() {
+    rm -rf "$test_repo"
+}
+trap cleanup EXIT
+
+mkdir -p "$test_repo/scripts" "$test_repo/bin"
+cp "$repo_dir/package.json" "$test_repo/package.json"
+cp "$scripts_dir/dd_trace_versions.sh" "$test_repo/scripts/dd_trace_versions.sh"
+cp "$scripts_dir/install_deps.sh" "$test_repo/scripts/install_deps.sh"
+cp "$scripts_dir/set_ddtrace_version.js" "$test_repo/scripts/set_ddtrace_version.js"
+
+# Avoid a network install while preserving Yarn's relevant behavior: verify
+# the temporary v5 manifest and create the lockfile that a real install would.
+cat > "$test_repo/bin/yarn" <<'EOF'
+#!/bin/bash
+set -euo pipefail
+
+case " $* " in
+    *" --ignore-engines "*) ;;
+    *) echo "install did not pass --ignore-engines" >&2; exit 1 ;;
+esac
+case " $* " in
+    *" --frozen-lockfile "*) echo "v5 install unexpectedly froze the lockfile" >&2; exit 1 ;;
+esac
+
+expected=$(sed -n 's/^DD_TRACE_V5_VERSION="\([^"]*\)"/\1/p' scripts/dd_trace_versions.sh)
+actual=$(node -p "require('./package.json').devDependencies['dd-trace']")
+if [ "$actual" != "$expected" ]; then
+    echo "expected temporary dd-trace pin $expected, found $actual" >&2
+    exit 1
+fi
+
+touch yarn.lock
+EOF
+chmod +x "$test_repo/bin/yarn"
+
+PATH="$test_repo/bin:$PATH" TARGET_NODE_MAJOR=20 "$test_repo/scripts/install_deps.sh"
+
+cmp "$repo_dir/package.json" "$test_repo/package.json"
+if [ -e "$test_repo/yarn.lock" ]; then
+    echo "install_deps.sh left a generated yarn.lock in a lockfile-free context" >&2
+    exit 1
+fi
+
+echo "install_deps.sh supports a build context without yarn.lock"