Registry configuration mismatch: yarn.lock uses public registry despite CDN config

[spbolton]

Summary

Merge queue build failed due to npm registry 500 error, revealing a critical configuration mismatch: the project configures a BunnyCDN proxy for npm packages, but yarn.lock contains 3,292 hardcoded URLs pointing to the public registry, making the CDN configuration ineffective.

Failed Build

Run ID: 21917220798
URL: https://github.com/dotCMS/core/actions/runs/21917220798/job/63287577456
Error: Request failed "500 Internal Server Error" from registry.yarnpkg.com/blocking-elements/-/blocking-elements-0.1.1.tgz
Time: 2026-02-11 18:15:41 UTC

Root Cause

The Configuration Mismatch

Configured (nodejs-parent/pom.xml:56):

<arguments>config set registry https://dotcms-npm.b-cdn.net</arguments>

Reality:

1. ✅ Registry config runs successfully in CI
2. ✅ Yarn install runs with --frozen-lockfile
3. ❌ Yarn ignores the config and uses URLs from yarn.lock
4. ❌ All 3,292 packages in yarn.lock point to registry.yarnpkg.com
5. ❌ When public registry has issues, builds fail despite CDN

Evidence

# Current state
$ grep -c 'resolved "https://registry.yarnpkg.com' core-web/yarn.lock
3292

$ grep -c 'resolved "https://dotcms-npm.b-cdn.net' core-web/yarn.lock
0

Why CI config is ignored: The --frozen-lockfile flag (correctly used for reproducible builds) tells yarn to use URLs from yarn.lock's "resolved" fields, completely ignoring the configured registry.

Impact

• ⚠️ Builds depend on public registry availability despite BunnyCDN investment
• ⚠️ CDN proxy exists but provides zero protection
• ⚠️ Configuration gives false sense of reliability
• ⚠️ Future registry outages will cause build failures

Recommended Solution

Use .yarnrc file (Option 1)

Add checked-in registry configuration that applies to ALL environments (developers and CI):

Implementation Steps

1. Create core-web/.yarnrc:

   registry "https://dotcms-npm.b-cdn.net"

2. Regenerate yarn.lock:

   cd core-web
   rm yarn.lock
   yarn install
   # Verify: grep -c 'dotcms-npm.b-cdn.net' yarn.lock  # Should be ~3292

3. Remove redundant pom.xml config (nodejs-parent/pom.xml lines 49-58):

   • Delete the <execution id="config yarn registry"> block
   • .yarnrc handles this now

4. Test build:

   ./mvnw install -pl :dotcms-core-web -DskipTests

Why This Works

• Standard yarn configuration mechanism
• Single source of truth for all environments
• Developers automatically use BunnyCDN
• yarn.lock gets generated with CDN URLs
• --frozen-lockfile uses CDN URLs from lockfile
• No special hooks or CI magic needed

Benefits

✅ Builds become independent of public registry availability
✅ Realizes intended BunnyCDN proxy architecture
✅ Utilizes existing CDN infrastructure investment
✅ Automatic for developers (no workflow changes)
✅ BunnyCDN verified accessible: curl -I https://dotcms-npm.b-cdn.net/blocking-elements/-/blocking-elements-0.1.1.tgz returns 200 OK

Alternative: Remove CDN Config

If CDN maintenance burden exceeds value, remove the pom.xml config entirely to match reality (accept public registry dependency).

References

• Build log line 3792: Registry successfully configured to CDN
• Build log line 3816: Error fetching from yarnpkg.com (not CDN)
• core-web/yarn.lock:10034: Hardcoded yarnpkg.com URL for blocking-elements
• nodejs-parent/pom.xml:56: CDN registry configuration

Immediate Workaround

The specific build can be retried (registry is healthy now), but the underlying configuration issue persists and will cause future failures during registry outages.

[spbolton]

This issue is being addressed in PR #34676

[github-actions]

PRs linked to this issue

• fix(build): Registry configuration mismatch yarn.lock uses pub (#34619) by @spbolton

PRs linked to this issue

• fix(build): Registry configuration mismatch yarn.lock uses pub (#34619) by @spbolton
• fix(pre-commit): enforce BunnyCDN registry URLs in yarn.lock by @hmoreras