fix: --lockfile-only in CI and with frozen-lockfile=true (#4955)

close #4951

.changeset/lucky-icons-give.md

@@ -0,0 +1,7 @@
+---
+"@pnpm/core": patch
+"@pnpm/plugin-commands-installation": patch
+"pnpm": patch
+---
+
+Never skip lockfile resolution when the lockfile is not up-to-date and `--lockfile-only` is used. Even if `frozen-lockfile` is `true` [#4951](https://github.com/pnpm/pnpm/issues/4951).

packages/core/src/install/index.ts

@@ -269,7 +269,7 @@ export async function mutateModules (
       !opts.fixLockfile &&
       installsOnly &&
       (
-        frozenLockfile ||
+        frozenLockfile && !opts.lockfileOnly ||
         opts.ignorePackageManifest ||
         !needsFullResolution &&
         opts.preferFrozenLockfile &&

packages/core/test/install/lockfileOnly.ts

@@ -76,3 +76,23 @@ test('warn when installing with lockfileOnly = true and node_modules exists', as
   const currentLockfile = await project.readCurrentLockfile()
   expect(currentLockfile.packages['/rimraf/2.5.1']).toBeFalsy()
 })
+
+// For @pnpm/core it might make sense to throw an exception in this case but for now it is better than having
+// the https://github.com/pnpm/pnpm/issues/4951 issue.
+test('always update the lockfile when lockfileOnly is used, even if frozenLockfile is used', async () => {
+  const project = prepareEmpty()
+  await addDependenciesToPackage({}, ['is-positive@1.0.0'], await testDefaults({
+    lockfileOnly: true,
+  }))
+  await install({
+    dependencies: {
+      'is-positive': '2.0.0',
+    },
+  }, await testDefaults({
+    lockfileOnly: true,
+    frozenLockfile: true,
+  }))
+
+  const lockfile = await project.readLockfile()
+  expect(lockfile.specifiers['is-positive']).toBe('2.0.0')
+})

packages/plugin-commands-installation/src/install.ts

@@ -300,7 +300,7 @@ export async function handler (
   }
   return installDeps({
     ...opts,
-    frozenLockfileIfExists: isCI &&
+    frozenLockfileIfExists: isCI && !opts.lockfileOnly &&
       typeof opts.rawLocalConfig['frozen-lockfile'] === 'undefined' &&
       typeof opts.rawLocalConfig['prefer-frozen-lockfile'] === 'undefined',
     include,