[Bug?]: yarn workspaces focus does not default to --immutable on CI

[ranisalt]

Self-service

• I'd be willing to implement a fix

Describe the bug

When running yarn install on CI (GitHub Actions in my specific scenario), it will enable --immutable and prevent continuing if the install happens to update the lockfile. However, then focus installing - which we do to speed up installing dependencies on CI - it does not. There is no --immutable flag to workspaces focus yet for me to manually enable it either.

Running yarn install --mode=update-lockfile as a separate step works but I would like to avoid the extra step, since install already has that behavior and workspaces focus should follow suit.

To reproduce

package.json:

{
  "name": "yarn-bug",
  "packageManager": "yarn@4.1.1",
  "dependencies": {
    "lodash": "4.17.21"
  }
}

yarn.lock:

# This file is generated by running "yarn install" inside your project.
# Manual changes might be lost - proceed with caution!

__metadata:
  version: 8
  cacheKey: 10c0

"lodash@npm:4.17.20":
  version: 4.17.20
  resolution: "lodash@npm:4.17.20"
  checksum: 10c0/faec37cb9f161b766bdc078a1356a07b9eaaa867796dd2520a407fe0a6a6d7be031e8f228f0cf3d305095703ee40258616c870b8d17dcdcb16f745bf31e8c3c2
  languageName: node
  linkType: hard

"yarn-bug@workspace:.":
  version: 0.0.0-use.local
  resolution: "yarn-bug@workspace:."
  dependencies:
    lodash: "npm:4.17.20"
  languageName: unknown
  linkType: soft

Running yarn install --immutable (or running in CI) results in the following:

➤ YN0000: · Yarn 4.1.1
➤ YN0000: ┌ Resolution step
➤ YN0085: │ + lodash@npm:4.17.21
➤ YN0085: │ - lodash@npm:4.17.20
➤ YN0000: └ Completed

➤ YN0000: ┌ Post-resolution validation
➤ YN0000: │ @@ -4,18 +4,17 @@
➤ YN0000: │  __metadata:
➤ YN0000: │    version: 8
➤ YN0000: │    cacheKey: 10c0
➤ YN0000: │
➤ YN0028: │ -"lodash@npm:4.17.20":
➤ YN0028: │ -  version: 4.17.20
➤ YN0028: │ -  resolution: "lodash@npm:4.17.20"
➤ YN0028: │ -  checksum: 10c0/faec37cb9f161b766bdc078a1356a07b9eaaa867796dd2520a407fe0a6a6d7be031e8f228f0cf3d305095703ee40258616c870b8d17dcdcb16f745bf31e8c3c2
➤ YN0028: │ +"lodash@npm:4.17.21":
➤ YN0028: │ +  version: 4.17.21
➤ YN0028: │ +  resolution: "lodash@npm:4.17.21"
➤ YN0000: │    languageName: node
➤ YN0000: │    linkType: hard
➤ YN0000: │
➤ YN0000: │  "yarn-bug@workspace:.":
➤ YN0000: │    version: 0.0.0-use.local
➤ YN0000: │    resolution: "yarn-bug@workspace:."
➤ YN0000: │    dependencies:
➤ YN0028: │ -    lodash: "npm:4.17.20"
➤ YN0028: │ +    lodash: "npm:4.17.21"
➤ YN0000: │    languageName: unknown
➤ YN0000: │    linkType: soft
➤ YN0000: │
➤ YN0028: │ The lockfile would have been modified by this install, which is explicitly forbidden.
➤ YN0000: └ Completed
➤ YN0000: · Failed with errors in 0s 22ms

It is not possible to run yarn workspaces focus --immutable and in CI it silently updates the lockfile.

Environment

System:
    OS: macOS 14.4.1
    CPU: (10) arm64 Apple M1 Pro
  Binaries:
    Node: 20.11.1 - /private/var/folders/03/j2jymg9n377bdxjh26rpckv40000gp/T/xfs-ee1b3860/node
    Yarn: 4.1.1 - /private/var/folders/03/j2jymg9n377bdxjh26rpckv40000gp/T/xfs-ee1b3860/yarn
    npm: 10.2.4 - ~/.config/asdf/plugins/nodejs/shims/npm

Additional context

The link to sherlock documentation is broken