Force npmjs registry for yarn install

[rarkins]

There exists a problem where yarn install (i.e. generating yarn.lock) can fail because (a) yarn defaults to using its own proxy/mirror of npmjs, and (b) that proxy is not perfectly up-to-date. So a new version of a package can be published to npmjs, which Renovate detects and updates package.json, but then yarn install fails because the yarn registry returns a 404 for that particular version.

My issue in the yarn repository: yarnpkg/yarn#5169

Proposal: "force" yarn to use the npmjs registry for install instead.

Ensure .yarnrc exists and first line is registry "https://registry.npmjs.org"

[rarkins]

Unfortunately this may be a bad idea, because yarn put the full path of their registry in every lockfile. i.e. if we install from npmjs, every entry in the lockfile might switch from yarnpkg to npmjs and then back again if a user updates the lockfile themselves.

[rarkins]

Here is the root cause: yarnpkg/yarn#5169

[rarkins]

The second option is to use the yarn registry for our npm dependency lookups if the user has a yarn.lock present. This essentially "slows down" yarn users though, in order to make sure they don't get lockfile errors.

Unfortunately this may be a bad idea, because yarn put the full path of their registry in every lockfile.

Agreed on this point.

On a related note: In our use of Renovate we rely on a .npmrc file that is dumped into a checked out directory of the renovate source code, and that .npmrc file configures several internal registry proxies (We rely on Yarn reading .npmrc).

Also cross-referencing a discussion on the removal of URLs from the lockfile -
yarnpkg/rfcs#64

[edmorley]

Do the logs contain enough detail to work out:
(a) what proportion of new packages are affected by this,
(b) how long after package publishing was the request made to yarn's registry that 404ed,
(c) (if renovate retries) how long after the package being published did yarn registry stop reporting the 404?

This may help the Yarn team to identify a cause and/or reveal how long a delay Renovate would need to add for repositories using yarn.

[rarkins]

I'm starting to suspect that this problem has gone away, with a small chance that I misunderstood it to start with. Before Christmas, I was debugging yarn.lock failures in logs and found that the "unexplained" ones always were yarn failures - not npm - and they were always failing to install the dependency that was being updated.

However now I am not seeing those unexplained failures in the last month of logs. Today I enabled real-time listening to npmjs package updates so all repositories should start upgrading - and generating lock files - even sooner than ever before. If I don't see yarn.lock file errors soon then I'll close this issue as invalid.