From 868f2fb163a603bfb1644181ab0c8dabc925ee59 Mon Sep 17 00:00:00 2001
From: Jordan <jordan.mele@outlook.com.au>
Date: Sun, 27 Nov 2022 05:31:57 +1100
Subject: [PATCH] fix: `--lockfile-only` and `readPackage` hook modifying
 workspace packages (#5678)

close #5670
---
 .changeset/proud-schools-jump.md              |  7 ++++++
 pkg-manager/core/src/install/index.ts         |  1 +
 .../src/recursive.ts                          |  2 +-
 pnpm/test/hooks.ts                            | 25 +++++++++++++++++++
 4 files changed, 34 insertions(+), 1 deletion(-)
 create mode 100644 .changeset/proud-schools-jump.md

diff --git a/.changeset/proud-schools-jump.md b/.changeset/proud-schools-jump.md
new file mode 100644
index 00000000000..15e5dc41276
--- /dev/null
+++ b/.changeset/proud-schools-jump.md
@@ -0,0 +1,7 @@
+---
+"@pnpm/core": patch
+"@pnpm/plugin-commands-installation": patch
+"pnpm": patch
+---
+
+readPackage hooks should not modify the `package.json` files in a workspace [#5670](https://github.com/pnpm/pnpm/issues/5670).
diff --git a/pkg-manager/core/src/install/index.ts b/pkg-manager/core/src/install/index.ts
index 56938387bc0..571eae28dee 100644
--- a/pkg-manager/core/src/install/index.ts
+++ b/pkg-manager/core/src/install/index.ts
@@ -690,6 +690,7 @@ export type ImporterToUpdate = {
 } & DependenciesMutation
 
 export interface UpdatedProject {
+  originalManifest?: ProjectManifest
   manifest: ProjectManifest
   peerDependencyIssues?: PeerDependencyIssues
   rootDir: string
diff --git a/pkg-manager/plugin-commands-installation/src/recursive.ts b/pkg-manager/plugin-commands-installation/src/recursive.ts
index b57be0f983d..4c466c4a0b2 100755
--- a/pkg-manager/plugin-commands-installation/src/recursive.ts
+++ b/pkg-manager/plugin-commands-installation/src/recursive.ts
@@ -257,7 +257,7 @@ export async function recursive (
     if (opts.save !== false) {
       await Promise.all(
         mutatedPkgs
-          .map(async ({ manifest }, index) => writeProjectManifests[index](manifest))
+          .map(async ({ originalManifest, manifest }, index) => writeProjectManifests[index](originalManifest ?? manifest))
       )
     }
     return true
diff --git a/pnpm/test/hooks.ts b/pnpm/test/hooks.ts
index 7ed6e99b428..ca0b64e3077 100644
--- a/pnpm/test/hooks.ts
+++ b/pnpm/test/hooks.ts
@@ -37,6 +37,18 @@ test('readPackage hook in single project doesn\'t modify manifest', async () =>
   pkg = await loadJsonFile(path.resolve('package.json'))
   expect(pkg.dependencies).toBeFalsy() // remove & readPackage hook work
   await project.hasNot('is-positive')
+
+  // Reset for --lockfile-only checks
+  await fs.unlink('pnpm-lock.yaml');
+
+  await execPnpm(['install', '--lockfile-only'])
+  pkg = await loadJsonFile(path.resolve('package.json'))
+  expect(pkg.dependencies).toBeFalsy() // install --lockfile-only & readPackage hook work, without pnpm-lock.yaml
+
+  // runs with pnpm-lock.yaml should not mutate local projects
+  await execPnpm(['install', '--lockfile-only'])
+  pkg = await loadJsonFile(path.resolve('package.json'))
+  expect(pkg.dependencies).toBeFalsy() // install --lockfile-only & readPackage hook work, with pnpm-lock.yaml
 })
 
 test('readPackage hook in monorepo doesn\'t modify manifest', async () => {
@@ -79,6 +91,19 @@ test('readPackage hook in monorepo doesn\'t modify manifest', async () => {
   await execPnpm(['remove', 'is-positive', '--filter', 'project-a'])
   pkg = await loadJsonFile(path.resolve('project-a/package.json'))
   expect(pkg.dependencies).toBeFalsy() // remove & readPackage hook work
+
+  // Reset for --lockfile-only checks
+  await fs.unlink('pnpm-lock.yaml');
+
+  await execPnpm(['install', '--lockfile-only'])
+  pkg = await loadJsonFile(path.resolve('project-a/package.json'))
+  expect(pkg.dependencies).toBeFalsy() // install --lockfile-only & readPackage hook work, without pnpm-lock.yaml
+
+  // runs with pnpm-lock.yaml should not mutate local projects
+  await execPnpm(['install', '--lockfile-only'])
+  pkg = await loadJsonFile(path.resolve('project-a/package.json'))
+  expect(pkg.dependencies).toBeFalsy() // install --lockfile-only & readPackage hook work, with pnpm-lock.yaml
+
 })
 
 test('filterLog hook filters peer dependency warning', async () => {