Enforce --immutable on every yarn install, in CI and the release builds (#10389)

In the four GitHub Actions workflows the flag is documentation only, since
Yarn's enableImmutableInstalls already defaults to true whenever CI is set in
the environment, but making it explicit means the intent is visible in the
workflow rather than implied by the runner.

The six installs that run outside CI are where this actually changes
behaviour: the Makefile, the Dockerfile, and the pip, Linux, macOS and Windows
packaging builds all run with yarn.lock beside them, and until now any of them
would quietly rewrite the lockfile rather than fail. A release build that
rewrites the lockfile is shipping something other than what we reviewed, so
failing loudly there is the point of the exercise.

.github/workflows/check-javascript-style.yml

@@ -44,7 +44,7 @@ jobs:
       - name: Install Node modules
         run: |
           cd web
-          yarn install
+          yarn install --immutable
 
       - name: Run the linter
         run: |

.github/workflows/run-feature-tests-epas.yml

@@ -170,7 +170,7 @@ jobs:
       - name: Build the JS bundle
         run: |
           cd web
-          yarn install
+          yarn install --immutable
           yarn run bundle
 
       - name: Run the tests

.github/workflows/run-feature-tests-pg.yml

@@ -180,7 +180,7 @@ jobs:
       - name: Build the JS bundle
         run: |
           cd web
-          yarn install
+          yarn install --immutable
           yarn run bundle
 
       - name: Run the tests

.github/workflows/run-javascript-tests.yml

@@ -59,7 +59,7 @@ jobs:
       - name: Install Node modules
         run: |
           cd web
-          yarn install
+          yarn install --immutable
 
       - name: Run the tests
         run: |

Dockerfile

@@ -42,7 +42,7 @@ RUN --mount=type=bind,source=.git,target=/pgadmin4/.git \
     export CPPFLAGS="-DPNG_ARM_NEON_OPT=0" && \
     npm install -g corepack && \
     corepack enable && \
-    yarn install && \
+    yarn install --immutable && \
     yarn run bundle && \
     rm -rf yarn.lock \
            package.json \

Make.bat

@@ -283,7 +283,7 @@ REM Main build sequence Ends
         EXIT /B 1
     )
     CALL yarn set version %YARN_VERSION% || EXIT /B 1
-    CALL yarn install || EXIT /B 1
+    CALL yarn install --immutable || EXIT /B 1
     CALL npm rebuild || EXIT /B 1
 
     ECHO Bundling javascript...

Makefile

@@ -25,7 +25,7 @@ appbundle:
 	./pkg/mac/build.sh $(BUILD_OPTS)
 
 install-node:
-	cd web && yarn install
+	cd web && yarn install --immutable
 
 install-python:
 	./tools/setup-python-env.sh

pkg/linux/build-functions.sh

@@ -304,7 +304,7 @@ _copy_code() {
             exit 1
         fi
         yarn set version "${YARN_VERSION}"
-        yarn install
+        yarn install --immutable
         yarn run bundle
     popd > /dev/null || exit
 

pkg/mac/build-functions.sh

@@ -319,7 +319,7 @@ _complete_bundle() {
             exit 1
         fi
         yarn set version "${YARN_VERSION}"
-        yarn install 2>&1
+        yarn install --immutable 2>&1
 
         # Record the source commit hash before the heavy lint/webpack
         # steps. `yarn run` needs node_modules so this runs after install,

pkg/pip/build.sh

@@ -62,7 +62,7 @@ if [ -z "${YARN_VERSION}" ]; then
     exit 1
 fi
 yarn set version "${YARN_VERSION}"
-yarn install
+yarn install --immutable
 yarn run bundle
 
 # Copy the commit_hash file, it doesn't show up in git ls-files