fix(core): unbreak pnpm 11 installs by acknowledging build-script deps from generators (#36302)

## Current Behavior

pnpm 11 fails installs with `ERR_PNPM_IGNORED_BUILDS` when a
dependency's build scripts are neither allowed nor denied. Workspaces
generated by `create-nx-workspace` only allow `nx`, so any flow that
pulls in a build-script dependency hard-fails: jest 30 pulls in
`unrs-resolver` (via `jest-resolve`), vite pulls in `esbuild`, swc
setups pull in `@swc/core`, etc. This breaks preset installs for real
pnpm 11 users and is the dominant cause of the nightly E2E matrix
failures (~70 of 139 jobs die in `newProject()`):
https://github.com/nrwl/nx/actions/runs/28642151329

Three more nightly root causes ride along:

- When a plugin throws a non-Error value,
`formatAggregateCreateNodesError` crashes with `Cannot read properties
of undefined (reading 'split')`, masking the real error (js-strip-types
failures).
- `@angular/cli@22.0.5` raised its Node floor to `^22.22.3 || ^24.15.0`,
so `ng new` refuses to run on the matrix's pinned Node 22.13.0 / 24.0.0
(e2e-nx-init, e2e-angular).
- e2e tests `pnpm add` plugins directly (no generator runs first), so
they hit the strict build gate regardless of generator fixes.

## Expected Behavior

- Generators that introduce build-script dependencies record the
`allowBuilds` decision in `pnpm-workspace.yaml` before their install
task runs, via a new comment-preserving `acknowledgePnpmBuildScripts`
helper (exposed through `@nx/devkit/internal`): jest acknowledges
`unrs-resolver`, vite/esbuild acknowledge `esbuild`, swc setups
acknowledge `@swc/core`, nest acknowledges `@nestjs/core` (all `false` =
skipped, matching pnpm 10 behavior since they ship prebuilt binaries or
only print funding messages); cypress and detox set `true` because their
install scripts are required to function. Entries the user already set
are never overwritten; the helper no-ops for non-pnpm workspaces and
pnpm < 11. Generated workspaces no longer preseed entries for
dependencies they may never have.
- Non-Error `createNodes` failures are coerced to Errors in the
`AggregateCreateNodesError` constructor so the real failure always
surfaces.
- The e2e matrix pins Node 22.22.3 / 24.15.0, satisfying the Angular CLI
floor.
- e2e-created pnpm/lerna workspaces are seeded with `strictDepBuilds:
false` (pnpm 10's warn-and-skip behavior) since tests install plugins
without running generators first.

Known gap (documented in the commit): `nx add <plugin>` installs the
plugin package before its init generator runs, so a plugin whose own
dependency tree carries a build-script package (e.g. `@nx/jest` →
`jest-resolve` → `unrs-resolver`) still surfaces pnpm's `approve-builds`
error in that flow.

## Related Issue(s)

Nightly E2E matrix failure:
https://github.com/nrwl/nx/actions/runs/28642151329

<!-- polygraph-session-start -->
---
[View session information
↗](https://app.trypolygraph.com/orgs/6a061dcb561c062131116eca/sessions/PR-for-pnpm-11-ERR_PNPM_IGNORED_BUILDS-fix-f71af2eb)
<!-- polygraph-session-end -->

---------

Co-authored-by: nx-cloud[bot] <71083854+nx-cloud[bot]@users.noreply.github.com>
(cherry picked from commit e380258)

Author: FrozenPandaz

.github/workflows/ci.yml

@@ -15,7 +15,7 @@ env:
   PNPM_HOME: ~/.pnpm
   # Pin corepack to the pnpm version from packageManager. Without this, corepack
   # falls back to "latest" in directories that have no packageManager field
-  # (e.g. e2e temp dirs), pulling pnpm 11 and breaking install.
+  # (e.g. e2e temp dirs) instead of the repo's pinned pnpm.
   COREPACK_DEFAULT_TO_LATEST: '0'
 
 jobs:

.github/workflows/e2e-matrix.yml

@@ -15,7 +15,7 @@ env:
   CYPRESS_CACHE_FOLDER: ${{ github.workspace }}/.cypress
   # Pin corepack to the pnpm version from packageManager. Without this, corepack
   # falls back to "latest" in directories that have no packageManager field
-  # (e.g. e2e temp dirs), pulling pnpm 11 and breaking install.
+  # (e.g. e2e temp dirs) instead of the repo's pinned pnpm.
   COREPACK_DEFAULT_TO_LATEST: '0'
 
 permissions: {}

.github/workflows/nightly/process-matrix.ts

@@ -78,15 +78,16 @@ const matrixData: MatrixData = {
       package_managers: ['npm', 'pnpm', 'yarn'],
       // TODO: re-add '26.0.0' once playwright ships the yauzl fix for node 26 extract hang.
       // See https://github.com/microsoft/playwright/issues/40724
-      node_versions: ['22.13.0', '24.0.0'],
+      // Floors track @angular/cli engines (^22.22.3 || ^24.15.0): ng new refuses older.
+      node_versions: ['22.22.3', '24.15.0'],
       excluded: ['e2e-detox', 'e2e-react-native', 'e2e-expo']
     },
     // Docker is not supported on ARM-based macOS runners (no nested virtualization)
     // See: https://github.com/docker/setup-docker-action and https://github.com/douglascamata/setup-docker-macos-action
     // We may want to look into adding intel only for this docker case, at least until vm-in-vm works on latest macos
     // TODO: re-add '26.0.0' once playwright ships the yauzl fix for node 26 extract hang.
     // See https://github.com/microsoft/playwright/issues/40724
-    { os: 'macos-latest', os_name: 'MacOS', os_timeout: 90, package_managers: ['npm'], node_versions: ['24.0.0'], excluded: ['e2e-docker'] }
+    { os: 'macos-latest', os_name: 'MacOS', os_timeout: 90, package_managers: ['npm'], node_versions: ['24.15.0'], excluded: ['e2e-docker'] }
     // TODO (Jack): Fix Windows support as gradle fails when running nx build https://staging.nx.app/runs/LgD4vxGn8w?utm_source=pull-request&utm_medium=comment
     // { os: 'windows-latest', os_name: 'WinOS', os_timeout: 180, package_managers: ['npm'], node_versions: ['24.0.0'], excluded: ['e2e-detox', 'e2e-react-native', 'e2e-expo'] }
   ]

.nx/workflows/agents.yaml

@@ -7,8 +7,9 @@ common-env-vars: &common-env-vars
   NX_NATIVE_LOGGING: 'nx::native::db'
   # Pin corepack to the pnpm version from packageManager. Without this, corepack
   # falls back to "latest" in directories that have no packageManager field
-  # (e.g. e2e temp dirs created by create-nx-workspace), pulling pnpm 11 and
-  # breaking install. Same treatment as .github/workflows/{ci,e2e-matrix}.yml.
+  # (e.g. e2e temp dirs created by create-nx-workspace) instead of the repo's
+  # pinned pnpm. Same treatment as .github/workflows/{ci,e2e-matrix}.yml, which
+  # pair it with `corepack prepare --activate` (see the init step below).
   COREPACK_DEFAULT_TO_LATEST: '0'
   # These are need for build and link validation for next.js and astro apps
   NEXT_PUBLIC_ASTRO_URL: 'https://master--nx-docs.netlify.app'
@@ -31,11 +32,20 @@ common-init-steps: &common-init-steps
   - name: Setup toolchains
     uses: 'nrwl/nx-cloud-workflows/v6/workflow-steps/install-mise/main.yaml'
 
+  # Make the repo's pinned pnpm corepack's default so e2e temp dirs (no
+  # packageManager field) resolve it too, instead of corepack's bundled
+  # last-known-good version.
+  - name: Activate repo pnpm via corepack
+    script: |
+      corepack enable
+      corepack prepare --activate
+
   - name: Verify toolchain versions
     script: |
       echo "mise:   $(mise --version)"
       echo "node:   $(node --version)"
       echo "pnpm:   $(pnpm --version)"
+      echo "pnpm outside repo: $(cd $(mktemp -d) && pnpm --version)"
       echo "bun:    $(bun --version)"
       echo "rust:   $(rustc --version) - $(cargo --version)"
       echo "dotnet: $(dotnet --version)"

e2e/angular/src/module-federation-setup.ts

@@ -25,8 +25,10 @@ export function setupModuleFederationTest(): ModuleFederationTestSetup {
 }
 
 export function cleanupModuleFederationTest(
-  setup: ModuleFederationTestSetup
+  setup: ModuleFederationTestSetup | undefined
 ): void {
   cleanupProject();
-  process.env.NX_E2E_VERBOSE_LOGGING = setup.oldVerboseLoggingValue;
+  // setup is undefined when setupModuleFederationTest itself failed; don't
+  // let cleanup throw and shadow the real error.
+  process.env.NX_E2E_VERBOSE_LOGGING = setup?.oldVerboseLoggingValue;
 }

e2e/gradle/project.json

@@ -20,7 +20,7 @@
       ],
       "dependsOn": [
         "@nx/nx-source:populate-local-registry-storage",
-        "@nx/nx-source:local-registry",
+        "@nx/nx-source:local-registry-e2e",
         ":gradle-project-graph:gradle:publishToMavenLocal"
       ]
     },
@@ -34,7 +34,7 @@
       ],
       "dependsOn": [
         "@nx/nx-source:populate-local-registry-storage",
-        "@nx/nx-source:local-registry",
+        "@nx/nx-source:local-registry-e2e",
         ":gradle-project-graph:gradle:publishToMavenLocal"
       ]
     }

e2e/jest/src/jest.test.ts

@@ -2,8 +2,10 @@ import { stripIndents } from '@angular-devkit/core/src/utils/literals';
 import {
   cleanupProject,
   expectJestTestsToPass,
+  getSelectedPackageManager,
   getStrippedEnvironmentVariables,
   newProject,
+  readFile,
   runCLI,
   runCLIAsync,
   uniq,
@@ -25,6 +27,21 @@ describe('Jest', () => {
     await expectJestTestsToPass('@nx/js:lib --unitTestRunner=jest');
   }, 500000);
 
+  it('should record an allowBuilds decision for unrs-resolver on pnpm', () => {
+    if (getSelectedPackageManager() !== 'pnpm') {
+      return;
+    }
+
+    const name = uniq('lib');
+    runCLI(
+      `generate @nx/js:lib ${name} --unitTestRunner=jest --no-interactive`
+    );
+
+    // pnpm 11 refuses to install deps whose build scripts are neither allowed
+    // nor denied, so the jest init generator must have recorded a decision
+    expect(readFile('pnpm-workspace.yaml')).toContain('unrs-resolver: false');
+  }, 300_000);
+
   it('should be resilient against NODE_ENV values', async () => {
     const name = uniq('lib');
     runCLI(

e2e/lerna-smoke-tests/src/lerna-smoke-tests.test.ts

@@ -67,11 +67,11 @@ describe('Lerna Smoke Tests', () => {
       result = result
         .replace(/.*\/node_modules\/.*\n/, '') // yarn adds "$ /node_modules/.bin/lerna run print-name" to the output
         .replace(/.*package-1@0.*\n/, '') // yarn output doesn't contain "> package-1@0.0.0 print-name"
-        .replace('$ echo test-package-1', '> echo test-package-1');
+        // npm and yarn echo the script command; pnpm 11 does not
+        .replace(/[$>] echo test-package-1\n/, '');
       expect(result).toMatchInlineSnapshot(`
 
                 > package-1:print-name
-                > echo test-package-1
                 test-package-1
                 Lerna (powered by Nx)   Successfully ran target print-name for project package-1
                 Run duration: {DURATION}

e2e/maven/project.json

@@ -9,14 +9,14 @@
     "e2e-local": {
       "dependsOn": [
         "@nx/nx-source:populate-local-registry-storage",
-        "@nx/nx-source:local-registry",
+        "@nx/nx-source:local-registry-e2e",
         "nx-maven-plugin:install"
       ]
     },
     "e2e-ci--**/**": {
       "dependsOn": [
         "@nx/nx-source:populate-local-registry-storage",
-        "@nx/nx-source:local-registry",
+        "@nx/nx-source:local-registry-e2e",
         "nx-maven-plugin:install"
       ]
     }

e2e/release/src/custom-registries.test.ts

@@ -233,7 +233,9 @@ describe('nx release - custom npm registries', () => {
     runCLI(`generate setup-verdaccio`);
 
     const process = await runCommandUntil(
-      `local-registry @proj/source --port=${verdaccioPort}`,
+      // location=none so a killed process can't leak registry config into
+      // ~/.npmrc; every consumer passes --registry explicitly instead
+      `local-registry @proj/source --port=${verdaccioPort} --location none`,
       (output) => output.includes(`warn --- http address`)
     );