ci(BE-252): single yellowstone-grpc + rpc-websockets lockfile check

.github/workflows/ci.yml

@@ -0,0 +1,43 @@
+# Lint / build checks for PRs and mainline branches (see BE-252).
+name: CI
+
+on:
+  pull_request:
+  push:
+    branches: [master, staging]
+
+jobs:
+  build:
+    runs-on: ubicloud
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: "24"
+          cache: yarn
+
+      - name: Enable Corepack (uses packageManager from package.json)
+        run: corepack enable
+
+      - name: Install dependencies
+        run: yarn install --frozen-lockfile
+
+      - name: Check single resolved version for gRPC-related packages
+        run: yarn check:grpc-deps
+
+      - name: Verify duplicate lockfile fixture fails the checker
+        run: |
+          set +e
+          YARN_LOCK_PATH=scripts/fixtures/yarn-lock-dup-yellowstone.lock yarn check:grpc-deps
+          code=$?
+          set -e
+          if [ "$code" -ne 1 ]; then
+            echo "Expected check to exit 1 on fixture with duplicate @triton-one/yellowstone-grpc, got $code"
+            exit 1
+          fi
+
+      - name: Build
+        run: yarn build

.github/workflows/deploy-on-drift-common-update.yml

@@ -22,10 +22,11 @@ jobs:
           node-version: "24"
           registry-url: "https://registry.npmjs.org"
 
+      - name: Enable Corepack
+        run: corepack enable
+
       - name: Install dependencies
-        run: |
-          yarn install
-          yarn build
+        run: yarn install
 
       # Handle sdk-update event (from protocol repo)
       # Payload: { version: "x.x.x" } - the SDK version
@@ -43,9 +44,10 @@ jobs:
         if: github.event_name == 'repository_dispatch' && github.event.client_payload.common-version
         run: yarn add @drift-labs/common@${{ github.event.client_payload.common-version }}
 
-      - name: Build after new dependency
-        if: github.event_name == 'repository_dispatch'
-        run: yarn run build
+      - name: Check gRPC deps and build
+        run: |
+          yarn check:grpc-deps
+          yarn build
 
       - name: Commit and push changes
         if: github.event_name == 'repository_dispatch'

package.json

@@ -1,6 +1,7 @@
 {
 	"name": "@drift-labs/dlob-server",
 	"version": "0.1.0",
+	"packageManager": "yarn@1.22.22",
 	"author": "wphan",
 	"main": "lib/index.js",
 	"license": "Apache-2.0",
@@ -60,7 +61,9 @@
 		"ts-node": "^10.9.1"
 	},
 	"resolutions": {
-		"@solana/web3.js": "1.98.0"
+		"@solana/web3.js": "1.98.0",
+		"@triton-one/yellowstone-grpc": "5.0.5",
+		"rpc-websockets": "9.3.2"
 	},
 	"scripts": {
 		"prepare": "husky install",
@@ -86,8 +89,9 @@
 		"lint": "eslint . --ext ts --quiet",
 		"lint:fix": "eslint . --ext ts --fix",
 		"playground": "ts-node src/playground.ts",
-		"test": "jest",
-		"test:watch": "jest --watch"
+		"check:grpc-deps": "node scripts/check-unique-yarn-versions.js",
+		"test": "jest src/utils/tests/auctionParams.test.ts",
+		"test:watch": "jest src/utils/tests/auctionParams.test.ts --watch"
 	},
 	"jest": {
 		"preset": "ts-jest",

scripts/check-unique-yarn-versions.js

@@ -0,0 +1,93 @@
+#!/usr/bin/env node
+/**
+ * Ensures Yarn v1 lockfile lists at most one resolved semver for each watched package.
+ * Duplicates mean multiple copies can be installed (e.g. SDK vs app drift).
+ *
+ * Usage: node scripts/check-unique-yarn-versions.js
+ * Override lock path: YARN_LOCK_PATH=path/to/yarn.lock node scripts/check-unique-yarn-versions.js
+ */
+
+const fs = require("fs");
+const path = require("path");
+
+const WATCHED = [
+	"@triton-one/yellowstone-grpc",
+	"rpc-websockets",
+];
+
+function collectResolvedVersions(lockContent, packageName) {
+	const versions = new Set();
+	const lines = lockContent.split(/\r?\n/);
+	const isScoped = packageName.startsWith("@");
+
+	for (let i = 0; i < lines.length; i++) {
+		const line = lines[i];
+		let matched = false;
+
+		if (isScoped) {
+			const escaped = packageName.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+			matched = new RegExp(`^"${escaped}@[^"]+":\\s*$`).test(line);
+		} else {
+			const escaped = packageName.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+			matched = new RegExp(`^${escaped}@[^:]+:\\s*$`).test(line);
+		}
+
+		if (!matched) {
+			continue;
+		}
+
+		for (let j = i + 1; j < Math.min(i + 30, lines.length); j++) {
+			const vm = lines[j].match(/^\s+version "([^"]+)"/);
+			if (vm) {
+				versions.add(vm[1]);
+				break;
+			}
+			// Next top-level key — malformed block
+			if (/^[^ \t#]/.test(lines[j]) && lines[j].trim() !== "") {
+				break;
+			}
+		}
+	}
+
+	return versions;
+}
+
+function main() {
+	const lockPath = path.resolve(
+		process.env.YARN_LOCK_PATH || path.join(process.cwd(), "yarn.lock")
+	);
+
+	if (!fs.existsSync(lockPath)) {
+		console.error(`check-unique-yarn-versions: missing lockfile: ${lockPath}`);
+		process.exit(1);
+	}
+
+	const lockContent = fs.readFileSync(lockPath, "utf8");
+	let failed = false;
+
+	for (const pkg of WATCHED) {
+		const versions = collectResolvedVersions(lockContent, pkg);
+		if (versions.size === 0) {
+			console.error(
+				`check-unique-yarn-versions: no "${pkg}" entries found in ${lockPath}`
+			);
+			failed = true;
+			continue;
+		}
+		if (versions.size > 1) {
+			console.error(
+				`check-unique-yarn-versions: "${pkg}" has multiple resolved versions in the lockfile (${[
+					...versions,
+				].sort().join(", ")}). Align dependencies or use resolutions.`
+			);
+			failed = true;
+		} else {
+			const [v] = [...versions];
+			console.log(`check-unique-yarn-versions: OK ${pkg}@${v}`);
+		}
+	}
+
+	process.exit(failed ? 1 : 0);
+}
+
+main();

scripts/fixtures/yarn-lock-dup-yellowstone.lock

@@ -0,0 +1,11 @@
+"@triton-one/yellowstone-grpc@5.0.2":
+  version "5.0.2"
+  resolved "https://registry.yarnpkg.com/@triton-one/yellowstone-grpc/-/yellowstone-grpc-5.0.2.tgz#dummy"
+
+"@triton-one/yellowstone-grpc@5.0.4":
+  version "5.0.4"
+  resolved "https://registry.yarnpkg.com/@triton-one/yellowstone-grpc/-/yellowstone-grpc-5.0.4.tgz#dummy"
+
+rpc-websockets@9.3.2:
+  version "9.3.2"
+  resolved "https://registry.yarnpkg.com/rpc-websockets/-/rpc-websockets-9.3.2.tgz#dummy"