From 250f8be6ad020d2b063b474cf585d0cb17c680b4 Mon Sep 17 00:00:00 2001
From: BigDataDZ <76271875+BigDataDZ@users.noreply.github.com>
Date: Mon, 19 Oct 2026 15:27:17 +0800
Subject: [PATCH] fix(dsh): preserve frozen overrides across pnpm versions

Signed-off-by: BigDataDZ <76271875+BigDataDZ@users.noreply.github.com>
---
 .github/workflows/dsh-plugin.yml              | 24 +++++++++++++++++++
 packages/dsh-loopx-plugin/pnpm-workspace.yaml |  8 +++++++
 2 files changed, 32 insertions(+)

diff --git a/.github/workflows/dsh-plugin.yml b/.github/workflows/dsh-plugin.yml
index f78bddb0ea..e7af43ee47 100644
--- a/.github/workflows/dsh-plugin.yml
+++ b/.github/workflows/dsh-plugin.yml
@@ -22,6 +22,30 @@ concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
+  frozen-configuration:
+    name: dsh-pnpm-frozen (${{ matrix.pnpm }})
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    strategy:
+      fail-fast: false
+      matrix:
+        pnpm: ["9.15.9", "10.33.0", "12.10.1"]
+    defaults:
+      run:
+        working-directory: packages/dsh-loopx-plugin
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v6
+        with:
+          node-version: "24"
+      - uses: pnpm/action-setup@v4
+        with:
+          version: ${{ matrix.pnpm }}
+      - name: Qualify the frozen override configuration without dependency scripts
+        run: pnpm install --frozen-lockfile --lockfile-only --ignore-scripts
+      - name: Keep the qualified dependency graph unchanged
+        run: git diff --exit-code -- pnpm-lock.yaml
+
   distribution:
     name: dsh-plugin (${{ matrix.os }})
     runs-on: ${{ matrix.os }}
diff --git a/packages/dsh-loopx-plugin/pnpm-workspace.yaml b/packages/dsh-loopx-plugin/pnpm-workspace.yaml
index bb4ce15f27..cf3a2d3d50 100644
--- a/packages/dsh-loopx-plugin/pnpm-workspace.yaml
+++ b/packages/dsh-loopx-plugin/pnpm-workspace.yaml
@@ -1,3 +1,11 @@
+packages:
+  - '.'
+
+# pnpm 9 reads the package.json projection; newer pnpm reads this one.
+# The frozen-version matrix keeps both consistent with the existing lock.
+overrides:
+  '@deepseek-ai/libreoffice-kit>fflate': 0.8.3
+
 allowBuilds:
   '@deepseek-ai/dsh-subprocess-local': false
   '@google/genai': false