fix: pnpm deploy bugs for docs and viewer-dev (#6077)

Merging for testing since this can't be tested without a merge to master

fix(ci): use --no-frozen-lockfile for docs deploy (pnpm migration)

The Build and Deploy Docs workflow ran `pnpm install --frozen-lockfile` and
failed on every master push after the pnpm migration:

  [ERR_PNPM_OUTDATED_LOCKFILE] pnpm-lock.yaml is not up to date with
  platform/core/package.json
    - @ohif/ui (lockfile: workspace:*, manifest: 3.13.0-beta.90)

publish-version.mjs rewrites @ohif/* workspace deps from "workspace:*" to the
concrete release version and commits that bump to master, so the committed
manifests intentionally drift from pnpm-lock.yaml. Every CircleCI job already
passes --no-frozen-lockfile for exactly this reason (pnpm-workspace.yaml sets
frozenLockfile:true as the default); the docs workflow was the lone job still
using frozen and so broke the docs deploy.

Switch the docs install to --no-frozen-lockfile to match the rest of CI.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
@

* fix(ci): write npm auth token to ~/.npmrc so publishes authenticate

NPM_PUBLISH wrote the registry auth token to ~/repo/.npmrc (the repo root),
but publish-package.mjs does process.chdir(packageDirectory) and runs
`npm publish` from inside each package (platform/ui, extensions/*, ...). npm
reads the project .npmrc from that package dir and the user .npmrc from
$HOME -- it never walks up to ~/repo/.npmrc -- so every publish failed with
ENEEDAUTH ("need auth ... requires you to be logged in").

publish-package.mjs catches and swallows per-package publish errors, so
NPM_PUBLISH still exited 0 and reported green; the breakage was silent. As a
result no @ohif/* package newer than 3.13.0-beta.89 (the last publish before
the pnpm migration) reached npm -- beta.90 and beta.91 are missing and the
beta dist-tag is stuck at beta.89.

Write the token to ~/.npmrc (npm per-user config, read regardless of cwd)
instead. This also stops clobbering the committed workspace-config .npmrc
(node-linker=hoisted) at the repo root, which the in-job pnpm install/build
relies on. Applied to all three auth steps for consistency.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(docker): copy preinstall.js before pnpm install in builder stage

The builder stage copies only the package.json manifests, runs
`pnpm install --no-frozen-lockfile`, and copies the rest of the source
afterward (for layer caching). But the root package.json defines a
"preinstall" lifecycle script (node preinstall.js) that pnpm runs at the
start of install -- before the source copy -- so the script file was absent
and install aborted:

  . preinstall$ node preinstall.js
  Error: Cannot find module '/usr/src/app/preinstall.js' (MODULE_NOT_FOUND)
  ERROR: process "pnpm install --no-frozen-lockfile" did not complete

This surfaced once the .npmrc COPY fix (#6076) let the build advance past
the earlier COPY failure. preinstall.js is self-contained (it no-ops without
GITHUB_TOKEN and guards the AGENTS.md/CLAUDE.md symlink with existsSync), so
copying just the script into the early manifest layer is sufficient.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(build): declare postcss plugins in platform/app for Docker build

The shared root postcss.config.js (which platform/app re-exports) loads
postcss-import, postcss-preset-env, and cssnano, but none were declared in
platform/app or the root. They only reached node_modules by being hoisted
from platform/docs (postcss-import, postcss-preset-env) and transitively
(cssnano). The Docker image excludes platform/docs via .dockerignore and
libs/@cornerstonejs is not a workspace member, so under pnpm's stricter
node-linker=hoisted the app build failed to resolve the plugins:

  Loading PostCSS "postcss-preset-env" plugin failed:
  Cannot find module 'postcss-preset-env'

(The accompanying "Can't resolve assets/woff2/latin.woff2" error was a
cascade from the broken PostCSS chain and clears with this fix.)

Declare the three plugins the config explicitly loads as devDependencies of
platform/app, pinned to the versions already resolved by working builds
(postcss-import@14.1.0, postcss-preset-env@7.8.3, cssnano@5.1.15), so the
build no longer depends on incidental hoisting from docs.

The lockfile was regenerated against a workspace:* baseline so the only
@ohif change is none -- the diff adds just the postcss plugin trees, keeping
specifiers at workspace:* per the repo's convention. Verified by building the
full Docker image locally: rspack compiles with 0 errors and the image
exports successfully.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.circleci/config.yml

@@ -170,7 +170,13 @@ jobs:
             git config --global user.name "ohif-bot"
       - run:
           name: Authenticate with NPM registry
-          command: echo "//registry.npmjs.org/:_authToken=$NPM_TOKEN" > ~/repo/.npmrc
+          # Write the auth token to npm's per-user config (~/.npmrc), not the
+          # repo root. publish-package.mjs chdir's into each package dir to run
+          # `npm publish`, and npm only reads the project .npmrc from that dir
+          # plus the user .npmrc from $HOME -- it never sees ~/repo/.npmrc, so a
+          # root-level token yields ENEEDAUTH. Using ~/.npmrc also avoids
+          # clobbering the committed workspace-config .npmrc (node-linker=hoisted).
+          command: echo "//registry.npmjs.org/:_authToken=$NPM_TOKEN" > ~/.npmrc
       - run:
           name: build half of the packages (to avoid out of memory in circleci)
           command: |
@@ -202,7 +208,13 @@ jobs:
             git config --global user.name "ohif-bot"
       - run:
           name: Authenticate with NPM registry
-          command: echo "//registry.npmjs.org/:_authToken=$NPM_TOKEN" > ~/repo/.npmrc
+          # Write the auth token to npm's per-user config (~/.npmrc), not the
+          # repo root. publish-package.mjs chdir's into each package dir to run
+          # `npm publish`, and npm only reads the project .npmrc from that dir
+          # plus the user .npmrc from $HOME -- it never sees ~/repo/.npmrc, so a
+          # root-level token yields ENEEDAUTH. Using ~/.npmrc also avoids
+          # clobbering the committed workspace-config .npmrc (node-linker=hoisted).
+          command: echo "//registry.npmjs.org/:_authToken=$NPM_TOKEN" > ~/.npmrc
       - run:
           name: build half of the packages (to avoid out of memory in circleci)
           command: |
@@ -224,8 +236,14 @@ jobs:
           command: |
             node ./publish-version.mjs
       - run:
-          name: Again set the NPM registry (was deleted in the version script)
-          command: echo "//registry.npmjs.org/:_authToken=$NPM_TOKEN" > ~/repo/.npmrc
+          name: Re-assert the NPM auth token before publishing
+          # Write the auth token to npm's per-user config (~/.npmrc), not the
+          # repo root. publish-package.mjs chdir's into each package dir to run
+          # `npm publish`, and npm only reads the project .npmrc from that dir
+          # plus the user .npmrc from $HOME -- it never sees ~/repo/.npmrc, so a
+          # root-level token yields ENEEDAUTH. Using ~/.npmrc also avoids
+          # clobbering the committed workspace-config .npmrc (node-linker=hoisted).
+          command: echo "//registry.npmjs.org/:_authToken=$NPM_TOKEN" > ~/.npmrc
       - run:
           name: publish package dist
           command: |

.github/workflows/build-docs.yml

@@ -36,7 +36,13 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Install dependencies
-        run: pnpm install --frozen-lockfile
+        # Use --no-frozen-lockfile to match every CircleCI job. The release flow
+        # (publish-version.mjs) rewrites @ohif/* workspace deps from "workspace:*"
+        # to the concrete version and commits that bump to master, which leaves
+        # pnpm-lock.yaml out of sync with the manifests. pnpm-workspace.yaml sets
+        # frozenLockfile:true, so a master-triggered install must opt out or it
+        # fails with ERR_PNPM_OUTDATED_LOCKFILE.
+        run: pnpm install --no-frozen-lockfile
 
       # Removed Playwright tests and coverage generation steps
 

Dockerfile

@@ -34,8 +34,11 @@ RUN mkdir /usr/src/app
 WORKDIR /usr/src/app
 ENV PATH=/usr/src/app/node_modules/.bin:$PATH
 
-# Copy package manifests for install caching
-COPY package.json pnpm-lock.yaml pnpm-workspace.yaml .npmrc ./
+# Copy package manifests for install caching. preinstall.js is included because
+# the root package.json's "preinstall" lifecycle script (node preinstall.js)
+# runs during `pnpm install` below -- before the full source is copied -- so the
+# script file must already be present or install fails with MODULE_NOT_FOUND.
+COPY package.json pnpm-lock.yaml pnpm-workspace.yaml .npmrc preinstall.js ./
 COPY --parents ./extensions/*/package.json ./modes/*/package.json ./platform/*/package.json ./
 # Run the install before copying the rest of the files
 

platform/app/package.json

@@ -95,8 +95,11 @@
     "@rspack/plugin-react-refresh": "^2.0.0",
     "@types/node": "20.19.9",
     "cross-env": "7.0.3",
+    "cssnano": "5.1.15",
     "identity-obj-proxy": "3.0.x",
     "mini-css-extract-plugin": "2.9.2",
+    "postcss-import": "14.1.0",
+    "postcss-preset-env": "7.8.3",
     "shx": "0.3.4",
     "tailwindcss": "3.2.4"
   },