ci: stabilize pnpm native addon install in PR checks (#733)

Co-authored-by: Orca <help@stably.ai>

.github/workflows/e2e.yml

@@ -40,6 +40,18 @@ jobs:
         with:
           run_install: false
 
+      # Why: this job runs the same pnpm install path as pr.yml's verify
+      # job, so it needs the same pinned node-gyp override to avoid pnpm's
+      # broken bundled gyp_main.py on Linux. Gate on runner.os matches
+      # release.yml so the invariant "this workaround is Linux-only" is
+      # consistent across all three workflows, even though this job
+      # currently pins runs-on: ubuntu-latest.
+      - name: Use external node-gyp to avoid pnpm's bundled copy (Linux only)
+        if: runner.os == 'Linux'
+        run: |
+          npm install -g node-gyp@11.5.0
+          echo "npm_config_node_gyp=$(npm root -g)/node-gyp/bin/node-gyp.js" >> "$GITHUB_ENV"
+
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
 

.github/workflows/pr.yml

@@ -29,6 +29,22 @@ jobs:
         with:
           run_install: false
 
+      # Why: pnpm's bundled node-gyp ships gyp_main.py without execute
+      # permission, which breaks native module builds (e.g. node-pty's
+      # postinstall) with "/bin/sh: gyp_main.py: Permission denied".
+      # Pin the fallback to the lockfile's node-gyp version so CI stays
+      # reproducible while forcing pnpm to bypass its broken bundled copy.
+      # Gate on runner.os == 'Linux' to match release.yml — the
+      # npm-global path layout this step assumes is POSIX-shaped, and the
+      # failure has only been observed on Linux runners. Today this job
+      # pins runs-on: ubuntu-latest so the guard is a no-op, but it
+      # prevents a silent break if a Windows/macOS matrix is added later.
+      - name: Use external node-gyp to avoid pnpm's bundled copy (Linux only)
+        if: runner.os == 'Linux'
+        run: |
+          npm install -g node-gyp@11.5.0
+          echo "npm_config_node_gyp=$(npm root -g)/node-gyp/bin/node-gyp.js" >> "$GITHUB_ENV"
+
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
 

.github/workflows/release.yml

@@ -125,6 +125,21 @@ jobs:
           node-version-file: .nvmrc
           cache: pnpm
 
+      # Why: release builds hit the same native-module postinstall path as
+      # PR CI, so keep the pinned node-gyp override here too instead of
+      # relying on pnpm's bundled copy. Scoped to Linux via runner.os (not
+      # a specific matrix image) because the failing postinstall has only
+      # been observed on Linux runners — see run 25081763129. The macOS
+      # and Windows release jobs exercise the same pnpm install path and
+      # have not reproduced it, so keep the gate narrow until we know why.
+      # Using runner.os instead of matrix.os == 'ubuntu-latest' means the
+      # gate still works if another Linux matrix entry is added later.
+      - name: Use external node-gyp to avoid pnpm's bundled copy (Linux only)
+        if: runner.os == 'Linux'
+        run: |
+          npm install -g node-gyp@11.5.0
+          echo "npm_config_node_gyp=$(npm root -g)/node-gyp/bin/node-gyp.js" >> "$GITHUB_ENV"
+
       # Cache the Electron binary + electron-builder tool downloads (notarytool,
       # winCodeSign, nsis, squirrel, AppImage). Saves ~30-90s per job, incl. mac.
       - name: Cache electron-builder downloads