chore: use branch lock files

[marikaner]

While researching solutions to the pnpm merge conflicts we have, I found this: https://pnpm.io/git_branch_lockfiles

I would like to propose trying it out for a while and keep this setting if it doesn't cause problems.

[hyperspace-pr-bot]

Summary

The following content is AI-generated and provides a summary of the pull request:

---

Context

What this PR does and why it is needed

Enables pnpm branch lockfiles to reduce merge conflicts in the lockfile.

Two settings are added to pnpm-workspace.yaml:

• gitBranchLockfile: true — generates branch-specific lockfiles (e.g., pnpm-lock.branch-name.yaml) instead of committing directly to pnpm-lock.yaml.
• mergeGitBranchLockfilesBranchPattern: [main] — automatically merges branch lockfiles back into the main pnpm-lock.yaml when working on the main branch.

This is an experimental change to evaluate whether it improves the developer experience by reducing frequent lockfile merge conflicts.

Category: Chore

---

• 🔄 Regenerate and Update Summary
• ✏️ Insert as PR Description (deletes this comment)
• 🗑️ Delete comment

PR Bot Information

Version: 1.29.33

• Output Template: Repository PR Template
• File Content Strategy: Full file content
• Correlation ID: 08ee69d0-9c5d-11f1-9b12-b21508a2efff
• Summary Prompt: Default Prompt
• LLM: anthropic--claude-4.6-sonnet
• Event Trigger: pull_request.opened

[davidkna-sap]

@marikaner I also made a PR for this at some point I cannot find right now, but I think we would also need a workflow on main that actively merges the branch lockfiles.

Edit: SAP/cloud-sdk-js@48f453f87

[marikaner]

@marikaner I also made a PR for this at some point I cannot find right now, but I think we would also need a workflow on main that actively merges the branch lockfiles.

Edit: SAP/cloud-sdk-js@48f453f87

I expected that you already tried it 😊
I thought mergeGitBranchLockfilesBranchPattern does that automatically, but forgot that of course that's not merged back to main...

[davidkna-sap]

LGTM.
My only concern would be that main in mergeGitBranchLockfilesBranchPattern could lead to issues with the frozen lockfile setting but we will see, and that would be easy to fix.

[marikaner]

LGTM. My only concern would be that main in mergeGitBranchLockfilesBranchPattern could lead to issues with the frozen lockfile setting but we will see, and that would be easy to fix.

We still definitely need a workflow that updates the lockfile on main, if there are branch lockfiles, right? without that it is possible that we have multiple branch lockfiles on main at the time of a release.
this could be handled through an auto-merge-lockfile workflow on main. wdyt?

[davidkna-sap]

@marikaner This could also be handled along the changelog updates.

[InjunPark-sap]

LGTM. Two follow-ups before this settles:

1. Merge workflow on main — as discussed, branch lockfiles will accumulate without it. Suggest tracking this as a follow-up PR (reference:SAP/cloud-sdk-js@48f453f87).
2. CI --frozen-lockfile compat — worth verifying main CI doesn't fail after first branch lockfile is merged in.

[KavithaSiva]

I looked into this now, and we have a workflow that also updates pnpm lock files pnpm-update.yml.
Since it also creates a branch, the lock file updates might be done in the branch specific lock file, and right now it is not staged.

Either that or we add bot/monthly-transitive-dependency-update* pattern to mergeGitBranchLockfilesBranchPattern.

[davidkna-sap]

I looked into this now, and we have a workflow that also updates pnpm lock files pnpm-update.yml.
Since it also creates a branch, the lock file updates might be done in the branch specific lock file, and right now it is not staged.

As configured right now every renovate PR including lockfile updates should merge the lockfiles.

[KavithaSiva]

I looked into this now, and we have a workflow that also updates pnpm lock files pnpm-update.yml.
Since it also creates a branch, the lock file updates might be done in the branch specific lock file, and right now it is not staged.

As configured right now every renovate PR including lockfile updates should merge the lockfiles.

I don't understand, only branches created by renovate merges the lockfile correct? I am talking about the workflow which updates transitive dependencies in lock files, that creates branches of style bot/monthly-transitive-dependency-update*

[davidkna-sap]

Ok I never removed .github/workflows/pnpm-update.yml, but renovate also does weekly refreshes as part of the best-practices preset we use.

[KavithaSiva]

Ok I never removed .github/workflows/pnpm-update.yml, but renovate also does weekly refreshes as part of the best-practices preset we use.

Just read upon this, very cool, so we can remove the workflow.

[davidkna-sap]

[pp] I would prefer leaving out main, as any merged lockfile would not be committed back.

Suggested change

- main

Frozen Lockfiles do not appear to cause any issues on investigation.