RHDH multi-repo Yarn bump

Goal

Propagate a Yarn Berry 4.x bump across:

Renovate Yarn packageManager updates are disabled (RHIDP-17563). This skill is the bump path.

Branch: live line is main on GitHub and GitLab CEE.

What actually changes

yarn set version <to>                 # packageManager + yarnPath + .yarn/releases
chmod +x .yarn/releases/yarn-<to>.cjs
yarn install --mode=update-lockfile

When package.json defines prettier:check or prettier:fix, yarn-bump.sh runs yarn prettier --ignore-unknown --write on the changed files before commit. Yarn writes "**" in .yarnrc.yml; Prettier (rhdh-cli) requires '**'.

Plus pins Yarn cannot see: ENV YARN=, Containerfile / Dockerfile yarn_version= and literal yarn set version (including versions not in --from; denylist pins stay). yarn set version $yarn_version is left as a variable.

yarn-bump.sh runs curl -fsSL once against https://repo.yarnpkg.com/<to>/packages/yarnpkg-cli/bin/yarn.js (the same URL yarn set version uses) and installs that file into every bumped .yarn/releases directory. GitHub PRs and GitLab MRs commit yarn-<to>.cjs (mode 100755) plus the removed older binary. If the download fails, GitLab falls back to copying a binary produced by a GitHub bump.

Default path: yarn-bump.sh

SKILL=<this skill's directory>
JIRA_ISSUE=RHIDP-1234 "$SKILL/scripts/yarn-bump.sh"   # resolve latest 4.x, clone, bump, PR/MR
"$SKILL/scripts/yarn-bump.sh" --to 4.18.1 --issue RHIDP-1234 --dry-run

--issue / JIRA_ISSUE is required: the opener (/rhdh-pr-mr) refuses to publish without a key, so the scheduled bump carries the standing automation ticket. The key goes in the Related Jira: line; it does not mean a human is working the bump.

--attribution / RHDH_ATTRIBUTION (alias --assisted-by, RHDH_ASSISTED_BY) becomes the commit trailer and is forwarded to the opener. Default rhdh-yarn-bump — the script names itself and claims no model. An agent-driven run should pass what it knows, e.g. --attribution 'paseo (pi + DeepSeek V4.1 Flash (EnMaaS), thinking: off)'. A value that already starts with Assisted-By: or Generated-by: is used verbatim.

It resolves Yarn 4.x (@yarnpkg/cli; never stable / 5.x unless --to), downloads that CLI once, clones the six repos, skips open chore/automated-yarn-bump* PRs/MRs and denylist pins (4.8.1 / 4.9.2 / 4.15.0), bumps each tree with --bin (so the release binary is in the diff), commits as rhdh-bot with the Assisted-By: trailer, and opens PRs/MRs via sibling /rhdh-pr-mr, forwarding --issue and --attribution.

GitLab weekly-maintenance clones this skill pack and runs yarn-bump.sh after digest/bootc and before Quay cleanup.

Manual mutator (existing checkouts)

node "$SKILL/scripts/bump-yarn.js" --scan --root /path/to/repo
node "$SKILL/scripts/bump-yarn.js" --to 4.18.1 --from-all --root /path/to/rhdh-plugins
curl -fsSL -o /tmp/yarn-4.18.1.cjs \
  https://repo.yarnpkg.com/4.18.1/packages/yarnpkg-cli/bin/yarn.js
node "$SKILL/scripts/bump-yarn.js" --to 4.18.1 --bin /tmp/yarn-4.18.1.cjs \
  --from-all --root /path/to/rhdh-downstream

--from 4.12.0,4.14.1 is the default when --from-all is omitted. Lock refresh can exceed 45 minutes.

Anti-patterns

• Do not re-enable Renovate Yarn bumps; they miss Containerfile / ENV YARN=.
• Do not yarn set version stable — repos must share one exact 4.x.
• Do not download a separate Yarn binary per repo. One fetch from repo.yarnpkg.com, then --bin copies those bytes into every PR/MR. --copy-bin is only the fallback when that fetch fails.
• Do not special-case rhdh-1-rhel-9; both CEE repos default to main.
• Do not invent a model in --attribution. Unknown parts are dropped: the tool alone is honest, a guessed model is not.

Tests

node --test "$SKILL/tests/bump-yarn.test.mjs"
bash "$SKILL/tests/smoke-caller.sh"   # commit trailer + forwarded opener metadata

Completion

Done when matching workspaces sit on --to (packageManager, yarnPath, yarn-<to>.cjs mode 100755), extras rewritten, locks refreshed unless --no-refresh-locks, and PRs/MRs opened (or skipped for open bot PR / no diff).