fix: refresh yarn.lock to match bumped versions after release versioning

[frontegg-david]

Summary by CodeRabbit

• Chores
  • Enhanced release workflow to refresh dependency lockfiles after version updates, ensuring consistency and preventing installation failures on new release branches.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 92421ae1-205b-4d05-b262-a13071adf3dc

📥 Commits

Reviewing files that changed from the base of the PR and between 0d5aa99 and e193342.

⛔ Files ignored due to path filters (1)

• yarn.lock is excluded by !**/yarn.lock, !**/*.lock

📒 Files selected for processing (2)

• .github/workflows/create-release-branch.yml
• .github/workflows/publish-release.yml

---

📝 Walkthrough

Walkthrough

Two GitHub Actions workflows (create-release-branch.yml and publish-release.yml) each receive a new step that runs yarn install --mode=update-lockfile after the existing nx release version / internal dependency pin normalization steps, keeping yarn.lock consistent with the rewritten package.json files.

Changes

yarn.lock refresh in release workflows

Layer / File(s)	Summary
yarn.lock refresh steps .github/workflows/create-release-branch.yml, .github/workflows/publish-release.yml	Adds a "Refresh yarn.lock to match bumped versions" step to both workflows. Each step runs yarn install --mode=update-lockfile immediately after internal @frontmcp/* dependency pins are normalized, so the committed yarn.lock records the updated exact pins and downstream immutable-install checks won't fail.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

Possibly related PRs

• agentfront/frontmcp#356: Extends the same release-branch version bump flow that normalizes internal @frontmcp/* pins across libs/*/package.json and plugins/*/package.json.
• agentfront/frontmcp#358: Directly related publish-release.yml logic that rewrites internal @frontmcp/* version pins before committing, the exact step this PR's lockfile refresh follows.

Poem

🐰 The lockfile grew stale when versions were bumped,
Packages rewritten, the yarn.lock slumped.
A quick --mode=update-lockfile call,
And now the recorded pins match them all!
No more immutable errors shall block the deploy — 🎉
Hop along, release branch, off you go!

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix-build

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[github-actions]

Cherry-pick Conflict

Automatic cherry-pick to main failed due to merge conflicts.

An issue has been created with manual instructions. Please resolve if this change should also be in main.

[github-actions]

Performance Test Results

Status: ✅ All tests passed

Summary

Project	Tests	Passed	Warnings	Failed	Leaks
✅ demo-e2e-agents	4	4	0	0	0
✅ demo-e2e-cache	11	11	0	0	0
✅ demo-e2e-codecall	4	4	0	0	0
✅ demo-e2e-config	4	4	0	0	0
✅ demo-e2e-direct	3	3	0	0	0
✅ demo-e2e-elicitation	1	1	0	0	0
✅ demo-e2e-errors	4	4	0	0	0
✅ demo-e2e-hooks	3	3	0	0	0
✅ demo-e2e-multiapp	4	4	0	0	0
✅ demo-e2e-notifications	3	3	0	0	0
✅ demo-e2e-openapi	2	2	0	0	0
✅ demo-e2e-providers	4	4	0	0	0
✅ demo-e2e-public	4	4	0	0	0
✅ demo-e2e-redis	15	15	0	0	0
✅ demo-e2e-remember	4	4	0	0	0
✅ demo-e2e-remote	5	5	0	0	0
✅ demo-e2e-serverless	2	2	0	0	0
✅ demo-e2e-skills	15	15	0	0	0
✅ demo-e2e-standalone	2	2	0	0	0
✅ demo-e2e-transport-recreation	3	3	0	0	0
✅ demo-e2e-ui	4	4	0	0	0

Total: 101 tests across 21 projects

📊 View full report in workflow run

---

Generated at: 2026-06-21T17:16:22.007Z
Commit: 355af5af