Why pnpm-lock.yaml Should Usually Stay Outside Prettier

Whether pnpm-lock.yaml should be excluded from Prettier is a question of the source-of-truth generator, not of whether YAML can be formatted.

pnpm writes the dependency-resolution result to the lockfile.

Prettier formats human-maintained source.

Dependabot creates dependency-update diffs.

CI verifies installation from the lockfile in a pinned environment.

Mixing these responsibilities can make manual updates pass while bot pull requests fail only at the format check.

Assign ownership to each file

Target	Main responsibility
`package.json`	Human-maintained dependencies and scripts
`pnpm-lock.yaml`	Resolution result generated by pnpm
`.prettierignore`	Files excluded from Prettier input
`.gitignore`	Local files Git does not track
Dependabot configuration	Update frequency and scope
CI	Install reproducibility and code quality

Applications should normally commit the lockfile so that dependencies can be reproduced.

Do not exclude it through .gitignore; exclude it only from Prettier with .prettierignore.

The Prettier ignore guide uses gitignore-style patterns.

# .prettierignore
pnpm-lock.yaml

Pin the pnpm version through the packageManager field and CI setup.

Use the same pnpm generation family in local development and verification.

Separate CI responsibilities in this order:

- run: corepack enable
- run: pnpm install --frozen-lockfile
- run: pnpm exec prettier . --check
- run: pnpm run lint
- run: pnpm run build

Add project-specific tests when the repository provides a test script.

pnpm install --frozen-lockfile fails in CI when installation would need to update the lockfile.

This detects a package.json and lockfile mismatch separately from formatting.

GitHub Dependabot represents pnpm with package-ecosystem: "npm".

The minimal form is:

version: 2
updates:
  - package-ecosystem: "npm"
    directory: "/"
    schedule:
      interval: "weekly"
    versioning-strategy: "lockfile-only"

Check the supported ecosystems and Dependabot options for the adopted configuration.

If direct dependencies should also change, revisit why lockfile-only was selected.

In a monorepo, align package directories, lockfile locations, and CI working directories.

Check in this order:

After fetching the Dependabot branch locally, run the frozen install first.

Run the format check afterward so that dependency resolution and formatting failures remain separate.

When a team includes the lockfile in Prettier, manual updates, Dependabot, and CI must use the same Prettier version and configuration.

Formatting only human pull requests but not bot pull requests produces unstable diffs.

The readability benefit is limited, however.

Pinning the generator, suppressing unnecessary diffs, and preserving reproducible installation makes failures easier to investigate.

Do not format the lockfile merely because it is YAML; make pnpm the sole generator.

Exclude it from Prettier and run --frozen-lockfile with a pinned pnpm version in CI.

Treat Dependabot as another update path for the same lockfile.

This division verifies manual and bot updates against the same reproducibility standard.