Renovate resolves dependency updates with npm install --package-lock-only. That recomputes package-lock.json only and never writes anything to node_modules/. The postUpgradeTask then runs npm run format, i.e. prettier --write . — npm puts node_modules/.bin on PATH, but the directory does not exist, and the Renovate image carries no global prettier. So the task has never worked; it fails on every npm update PR, not intermittently.
Fix
Run npm ci before formatting so the exact pinned prettier and its plugins (prettier-plugin-svelte, prettier-plugin-tailwindcss) are present. A global prettier in the image would not do — it would format against a version other than the one each repo pins, and the plugins would still be missing.
--ignore-scripts because formatting needs no lifecycle scripts; --no-audit --no-fund to keep the log readable.
No server-side change needed
The self-hosted runner sets RENOVATE_ALLOWED_COMMANDS: '^npm .*$$,^npx .*$$'. npm ci --ignore-scripts --no-audit --no-fund matches ^npm .*$, so both commands are permitted as-is — whether the $$ is unescaped to $ or passed through literally.
Known unaffected-but-still-broken repo
mars3142/castaway extends this preset but has no package.json at the repo root (sources live in client/ and server/). The task fails there today and will keep failing, just at npm ci instead of at prettier. No regression, but it needs its own fix.
Verification
default.json parses as valid JSON. Both commands were checked against the runner's allowedCommands regexes. The real check is the next npm update PR in a consuming repo — after this merges, tick the rebase checkbox on hamer/website#81 and #83 to rebuild those branches.
Every npm update PR across all repos using this preset currently fails its `renovate/artifacts` check:
```
Command failed: npm run format --if-present
sh: 1: prettier: not found
```
Seen right now in [hamer/website#81](https://git.mars3142.dev/hamer/website/pulls/81) and [hamer/website#83](https://git.mars3142.dev/hamer/website/pulls/83).
## Cause
Renovate resolves dependency updates with `npm install --package-lock-only`. That recomputes `package-lock.json` only and never writes anything to `node_modules/`. The `postUpgradeTask` then runs `npm run format`, i.e. `prettier --write .` — npm puts `node_modules/.bin` on `PATH`, but the directory does not exist, and the Renovate image carries no global prettier. So the task has never worked; it fails on every npm update PR, not intermittently.
## Fix
Run `npm ci` before formatting so the exact pinned prettier and its plugins (`prettier-plugin-svelte`, `prettier-plugin-tailwindcss`) are present. A global prettier in the image would not do — it would format against a version other than the one each repo pins, and the plugins would still be missing.
`--ignore-scripts` because formatting needs no lifecycle scripts; `--no-audit --no-fund` to keep the log readable.
## No server-side change needed
The self-hosted runner sets `RENOVATE_ALLOWED_COMMANDS: '^npm .*$$,^npx .*$$'`. `npm ci --ignore-scripts --no-audit --no-fund` matches `^npm .*$`, so both commands are permitted as-is — whether the `$$` is unescaped to `$` or passed through literally.
## Known unaffected-but-still-broken repo
`mars3142/castaway` extends this preset but has no `package.json` at the repo root (sources live in `client/` and `server/`). The task fails there today and will keep failing, just at `npm ci` instead of at `prettier`. No regression, but it needs its own fix.
## Verification
`default.json` parses as valid JSON. Both commands were checked against the runner's `allowedCommands` regexes. The real check is the next npm update PR in a consuming repo — after this merges, tick the rebase checkbox on hamer/website#81 and #83 to rebuild those branches.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
https://claude.ai/code/session_011zP7KKVvLL5WoAW7a5Cdvn
The npm postUpgradeTask ran `npm run format --if-present` on a tree
Renovate had only lockfile-updated. `--package-lock-only` never writes
node_modules, and the Renovate image ships no global prettier, so npm
put a non-existent node_modules/.bin on PATH and every npm update PR
failed its artifact check with `sh: 1: prettier: not found`.
Run `npm ci` first so the pinned prettier and its plugins are actually
present. `--ignore-scripts` keeps lifecycle scripts out of it since
formatting needs none of them.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011zP7KKVvLL5WoAW7a5Cdvn
Signed-off-by: Peter Siegmund <peter.siegmund@entwicklung.eq-3.de>
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Every npm update PR across all repos using this preset currently fails its
renovate/artifactscheck:Seen right now in hamer/website#81 and hamer/website#83.
Cause
Renovate resolves dependency updates with
npm install --package-lock-only. That recomputespackage-lock.jsononly and never writes anything tonode_modules/. ThepostUpgradeTaskthen runsnpm run format, i.e.prettier --write .— npm putsnode_modules/.binonPATH, but the directory does not exist, and the Renovate image carries no global prettier. So the task has never worked; it fails on every npm update PR, not intermittently.Fix
Run
npm cibefore formatting so the exact pinned prettier and its plugins (prettier-plugin-svelte,prettier-plugin-tailwindcss) are present. A global prettier in the image would not do — it would format against a version other than the one each repo pins, and the plugins would still be missing.--ignore-scriptsbecause formatting needs no lifecycle scripts;--no-audit --no-fundto keep the log readable.No server-side change needed
The self-hosted runner sets
RENOVATE_ALLOWED_COMMANDS: '^npm .*$$,^npx .*$$'.npm ci --ignore-scripts --no-audit --no-fundmatches^npm .*$, so both commands are permitted as-is — whether the$$is unescaped to$or passed through literally.Known unaffected-but-still-broken repo
mars3142/castawayextends this preset but has nopackage.jsonat the repo root (sources live inclient/andserver/). The task fails there today and will keep failing, just atnpm ciinstead of atprettier. No regression, but it needs its own fix.Verification
default.jsonparses as valid JSON. Both commands were checked against the runner'sallowedCommandsregexes. The real check is the next npm update PR in a consuming repo — after this merges, tick the rebase checkbox on hamer/website#81 and #83 to rebuild those branches.🤖 Generated with Claude Code
https://claude.ai/code/session_011zP7KKVvLL5WoAW7a5Cdvn