A relative replace of a go.mod still resolves in the temporary modfile, so a module with a sibling package builds and verifies through the pins path

ensureModfile copied go.mod word for word into pins/<dir>/, where `go mod verify` runs, so a replace to ./x or ../x pointed nowhere (route-proxy's failure of 2026-11-02 13:53, met a second time with the release's sibling packages). Every relative replace target is now made absolute under the tree the go.mod came from. mesh-build-node installs a module's own npm packages in a scratch copy of package.json, so a file:, link: or portal: dependency on a relative path would fail the same way; it is refused naming the package and its path, as a module without a lock is. Quick fix: rewrite the one replace route-proxy had, in ensureModfile (minutes). Thorough fix: the kind, a go.mod or package.json copied away from its tree, for every replace form (single, block, with a version, ./ and ../) in the one place all copies go through (ensureModfile, which versions.go and the pins share), and the same kind in the other build module that copies a manifest. Chosen: thorough, since it was met twice and hides a failure until the delivery (quick-or-thorough, fix-a-bug-met-twice). Test: TestARelativeReplaceStillResolvesInTheTemporaryModfile runs real go mod verify in the pins directory. Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL
2026-11-02 19:36:20 +01:00
parent 7f4cc9e2ec
commit 640455999e
4 changed files with 108 additions and 1 deletions
@@ -283,6 +283,18 @@ func lockProblem(dir, rel string) (string, error) {
 	if _, err := os.Stat(filepath.Join(dir, "package-lock.json")); err != nil {
 		return fmt.Sprintf("%s names packages beyond the SDK and has no package-lock.json (%s): commit one", rel, strings.Join(names, ", ")), nil
 	}
+	_, pkg, _ := ownDependencies(dir)
+	for _, k := range []string{"dependencies", "peerDependencies", "optionalDependencies"} {
+		deps, _ := pkg[k].(map[string]any)
+		for _, name := range names {
+			spec, _ := deps[name].(string)
+			for _, scheme := range []string{"file:", "link:", "portal:"} {
+				if path, ok := strings.CutPrefix(spec, scheme); ok && (path == "." || path == ".." || strings.HasPrefix(path, "./") || strings.HasPrefix(path, "../")) {
+					return fmt.Sprintf("%s depends on %s by the relative path %s, which the install in a scratch copy cannot resolve: name the package from the registry", rel, name, spec), nil
+				}
+			}
+		}
+	}
 	return "", nil
 }