fix(docker): copy pnpm-workspace.yaml so overrides match the lockfile

[dcccrypto]

Fixes the docker job, which has failed on every push to main since 2026-06-22 (~4 weeks).

Symptom

ERR_PNPM_LOCKFILE_CONFIG_MISMATCH  Cannot proceed with the frozen installation.
The current "overrides" configuration doesn't match the value found in the lockfile

Root cause

989d893 moved pnpm.overrides out of package.json and into pnpm-workspace.yaml. The Dockerfile only ever copied package.json and pnpm-lock.yaml, so inside the image pnpm resolved zero overrides while pnpm-lock.yaml still recorded overrides: vite: 8.0.8. --frozen-lockfile refuses to proceed on that disagreement.

The tell that makes this easy to misdiagnose: CI's build-and-test job runs the same pnpm 10 and the same --frozen-lockfile, and passes. It passes only because actions/checkout gives it the entire repo, pnpm-workspace.yaml included. Just the docker build, with its narrower COPY context, was missing the file. So this is not a pnpm-version problem, despite the 10.34.5 → 11.14.0 upgrade notice in the failing log.

Fix

Copy pnpm-workspace.yaml in both the builder and runner stages.

Why not just regenerate the lockfile

The obvious-looking fix — pnpm install --no-frozen-lockfile to make the lockfile agree with an empty override set — would have silently dropped a security pin. That override is the K-1 HIGH CVE mitigation from 192d1b5: vite pinned to 8.0.8, closing GHSA-v2wj-q39q-566r, GHSA-p9ff-h696-f583, and GHSA-4w7w-66w2-5vf9. The correct direction is to give pnpm the overrides file, not to relax the lockfile.

Verification

Docker daemon isn't available in this environment, so I replicated each stage's exact COPY context into a scratch directory against pnpm 10.33.0 (same major as both CI and the image):

Stage context	Command	Result
package.json + pnpm-lock.yaml (current)	pnpm install --frozen-lockfile	❌ exit 1, reproduces the exact CI error
+ pnpm-workspace.yaml (this PR)	pnpm install --frozen-lockfile	✅ exit 0
+ pnpm-workspace.yaml (this PR)	pnpm install --frozen-lockfile --prod	✅ exit 0

pnpm why vite in the fixed builder context resolves to vite@8.0.8, confirming the K-1 pin is actually applied rather than merely unblocked.

Also confirmed there is no .dockerignore that would exclude the file, and that pnpm-workspace.yaml is git-tracked and therefore present in the build context.

Reviewer note

PR #371 adds a second override (ws → 8.21.0). Whichever of these two lands second should confirm the new override is declared in pnpm-workspace.yaml (not package.json) and is reflected in pnpm-lock.yaml, or the same mismatch returns.

🤖 Generated with Claude Code

[coderabbitai]

Warning

Review limit reached

@dcccrypto, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 13 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: feefe1d7-e14b-4fab-83c2-ce027ed8c4a6

📥 Commits

Reviewing files that changed from the base of the PR and between 952935c and 5d1b5d2.

📒 Files selected for processing (1)

• Dockerfile

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/keeper-docker-pnpm-workspace-overrides

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}