Build: Persist root node_modules to the CI workspace

scripts/ci/common-jobs.ts

@@ -29,6 +29,7 @@ export const build_linux = defineJob('Build (linux)', (workflowName) => ({
   },
   steps: [
     git.checkout(),
+    cache.attach(CACHE_KEYS()),
     npm.install('.'),
     ...(isTrustedAuthor() ? [cache.persist(CACHE_PATHS, CACHE_KEYS()[0])] : []),
     git.check(),
@@ -50,6 +51,17 @@ export const build_linux = defineJob('Build (linux)', (workflowName) => ({
     ...workflow.reportOnFailure(workflowName),
     artifact.persist(`code/bench/esbuild-metafiles`, 'bench'),
     workspace.persist([
+      // Workspace-root node_modules folders. Yarn hoists shared/singleton
+      // dependencies (e.g. `oxc-parser`, `vitest`, `type-fest`) here rather than
+      // into the per-package `code/<pkg>/node_modules` folders below. Downstream
+      // jobs otherwise only receive these via the shared `save_cache`, which is
+      // gated on `isTrustedAuthor()` — so community/fork PRs end up with a
+      // freshly-built `dist` but no root `node_modules`, producing errors like
+      // `Cannot find package 'oxc-parser'`. Persisting them to the (pipeline-
+      // scoped, un-gated) workspace makes downstream jobs correct for every PR.
+      `${WORKING_DIR}/node_modules`,
+      `${WORKING_DIR}/code/node_modules`,
+      `${WORKING_DIR}/scripts/node_modules`,
       ...glob
         .sync(['*/src', '*/*/src'], {
           cwd: join(dirname, '../../code'),

scripts/ci/sandboxes.ts

@@ -5,9 +5,7 @@ import { type TemplateKey } from '../../code/lib/cli-storybook/src/sandbox-templ
 import { build_linux } from './common-jobs.ts';
 import { LINUX_ROOT_DIR, SANDBOX_DIR, WINDOWS_ROOT_DIR, WORKING_DIR } from './utils/constants.ts';
 import {
-  CACHE_KEYS,
   artifact,
-  cache,
   server,
   testResults,
   toId,
@@ -247,7 +245,6 @@ export function defineSandboxFlow<Key extends string>(key: Key) {
         ...getSandboxSetupSteps(key),
         'checkout', // we need the full git history for chromatic
         workspace.attach(),
-        cache.attach(CACHE_KEYS()),
         {
           // we copy to the working directory to get git history, which chromatic needs for baselines
           run: {

scripts/ci/utils/helpers.ts

@@ -170,8 +170,9 @@ export const verdaccio = {
 export const workflow = {
   restoreLinux: (checkoutOpts: { forceHttps?: boolean; shallow?: boolean } = {}) => [
     git.checkout(checkoutOpts),
+    // Downstream jobs should consume precomputed outputs exclusively from the
+    // pipeline workspace to avoid stale cache interference and trust gating.
     workspace.attach(),
-    cache.attach(CACHE_KEYS()),
   ],
   restoreWindows: (at = WINDOWS_ROOT_DIR, checkoutOpts: { shallow?: boolean } = {}) => [
     git.checkout({ ...checkoutOpts, forceHttps: true }),