fg-devkit 1.12.6 → 1.12.8

package/scripts/node-toolchain-sync.mjs

@@ -0,0 +1,347 @@
+/**
+ * Sync Node toolchain files in a single repository from policy.toolchain.node.
+ */
+
+import fs from 'node:fs'
+import path from 'node:path'
+
+import {
+  deriveJenkinsImageTag,
+  normalizeNodeVersionLine,
+  resolveDockerNodeTag,
+  resolveExpectedNodePolicy,
+} from './dependency-policy-toolchain.mjs'
+
+const DOCKER_FROM_NODE_PATTERN = /FROM node:(v)?(\d+(?:\.\d+)?)(-[a-z0-9-]+)?/gi
+const JENKINS_NODE_IMAGE_PATTERN = /(feelgoodsvenska\/jenkins-build:)node\d+/g
+const GITHUB_NODE_VERSION_PATTERN = /node-version:\s*['"]?\d+(?:\.\d+)?['"]?/g
+
+/**
+ * @param {string} dir
+ * @returns {string[]}
+ */
+function findGithubWorkflows(dir) {
+  const workflowsDir = path.join(dir, '.github', 'workflows')
+  if (!fs.existsSync(workflowsDir)) {
+    return []
+  }
+  return fs
+    .readdirSync(workflowsDir, { withFileTypes: true })
+    .filter((entry) => entry.isFile() && /\.(ya?ml)$/i.test(entry.name))
+    .map((entry) => path.join(workflowsDir, entry.name))
+}
+
+/**
+ * @param {string} dir
+ * @param {string[]} dockerfileNames
+ * @returns {string[]}
+ */
+function findDockerfiles(dir, dockerfileNames = ['Dockerfile', 'Dockerfile.local']) {
+  const found = []
+  for (const name of dockerfileNames) {
+    const filePath = path.join(dir, name)
+    if (fs.existsSync(filePath)) {
+      found.push(filePath)
+    }
+  }
+  return found
+}
+
+/**
+ * @param {string} dir
+ * @returns {string[]}
+ */
+function findPackageJsonFiles(dir) {
+  const found = []
+  const skipDirNames = new Set([
+    'node_modules',
+    '.git',
+    '.next',
+    'dist',
+    'build',
+    'coverage',
+    'storybook-static',
+  ])
+
+  function walk(currentDir) {
+    for (const entry of fs.readdirSync(currentDir, { withFileTypes: true })) {
+      if (entry.isDirectory()) {
+        if (skipDirNames.has(entry.name) || entry.name.startsWith('.')) {
+          continue
+        }
+        walk(path.join(currentDir, entry.name))
+        continue
+      }
+
+      if (entry.name === 'package.json') {
+        found.push(path.join(currentDir, entry.name))
+      }
+    }
+  }
+
+  walk(dir)
+  return found.sort((a, b) => a.localeCompare(b))
+}
+
+/**
+ * @param {string} content
+ * @param {string} expectedNvmrc
+ * @param {string} [dockerTag] e.g. 22-alpine
+ * @returns {{ content: string, changed: boolean }}
+ */
+export function syncDockerfileNodeImages(content, expectedNvmrc, dockerTag) {
+  const imageTag = resolveDockerNodeTag(expectedNvmrc, dockerTag)
+  let changed = false
+
+  const updated = content.replace(DOCKER_FROM_NODE_PATTERN, (match) => {
+    const next = `FROM node:${imageTag}`
+    if (next !== match) {
+      changed = true
+    }
+    return next
+  })
+
+  return { content: updated, changed }
+}
+
+/**
+ * @param {string} content
+ * @param {string} jenkinsImageTag e.g. node22
+ * @returns {{ content: string, changed: boolean }}
+ */
+export function syncJenkinsfileNodeImage(content, jenkinsImageTag) {
+  let changed = false
+  const updated = content.replace(JENKINS_NODE_IMAGE_PATTERN, (match, prefix) => {
+    const next = `${prefix}${jenkinsImageTag}`
+    if (next !== match) {
+      changed = true
+    }
+    return next
+  })
+  return { content: updated, changed }
+}
+
+/**
+ * @param {string} content
+ * @param {string} expectedNvmrc
+ * @returns {{ content: string, changed: boolean }}
+ */
+export function syncGithubWorkflowNodeVersion(content, expectedNvmrc) {
+  const major = expectedNvmrc.split('.')[0]
+  let changed = false
+  const updated = content.replace(GITHUB_NODE_VERSION_PATTERN, (match) => {
+    const next = `node-version: ${major}`
+    if (next !== match) {
+      changed = true
+    }
+    return next
+  })
+  return { content: updated, changed }
+}
+
+/**
+ * @param {string} filePath
+ * @param {string} expected
+ * @param {boolean} dryRun
+ * @returns {string | null} change description
+ */
+function writeTextFileIfNeeded(filePath, expected, dryRun) {
+  const normalizedExpected = expected.trim()
+  const current = fs.existsSync(filePath) ? fs.readFileSync(filePath, 'utf8') : undefined
+  const normalizedCurrent = current === undefined ? undefined : normalizeNodeVersionLine(current)
+
+  if (normalizedCurrent === normalizedExpected) {
+    return null
+  }
+
+  const rel = path.basename(filePath)
+  const description =
+    current === undefined
+      ? `${rel}: (missing) -> ${normalizedExpected}`
+      : `${rel}: ${normalizedCurrent} -> ${normalizedExpected}`
+
+  if (!dryRun) {
+    fs.writeFileSync(filePath, `${normalizedExpected}\n`)
+  }
+  return description
+}
+
+/**
+ * @param {string} repoRoot
+ * @param {Record<string, unknown>} policy
+ * @param {{ dryRun?: boolean, fgDevkitRoot?: string }} [options]
+ * @returns {string[]} change descriptions
+ */
+export function syncNodeToolchainInRepo(repoRoot, policy, options = {}) {
+  const { dryRun = false, fgDevkitRoot } = options
+  const nodePolicy = resolveExpectedNodePolicy(policy, fgDevkitRoot)
+  if (!nodePolicy) {
+    return []
+  }
+
+  const changes = []
+  const { nvmrc, engines, jenkinsImage, dockerTag } = nodePolicy
+  const rootPackageJsonPath = path.join(repoRoot, 'package.json')
+  const hasRootPackageJson = fs.existsSync(rootPackageJsonPath)
+
+  if (hasRootPackageJson) {
+    const nvmrcPath = path.join(repoRoot, '.nvmrc')
+    const nvmrcChange = writeTextFileIfNeeded(nvmrcPath, nvmrc, dryRun)
+    if (nvmrcChange) {
+      changes.push(nvmrcChange)
+    }
+  }
+
+  const nodeVersionPath = path.join(repoRoot, '.node-version')
+  if (hasRootPackageJson && fs.existsSync(nodeVersionPath)) {
+    const nodeVersionChange = writeTextFileIfNeeded(nodeVersionPath, nvmrc, dryRun)
+    if (nodeVersionChange) {
+      changes.push(nodeVersionChange)
+    }
+  }
+
+  if (engines) {
+    for (const pkgPath of findPackageJsonFiles(repoRoot)) {
+      const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf8'))
+      const currentEngines = pkg.engines?.node
+      if (currentEngines === engines) {
+        continue
+      }
+
+      const relPkgPath = path.relative(repoRoot, pkgPath)
+      changes.push(`${relPkgPath} engines.node: ${currentEngines ?? '(missing)'} -> ${engines}`)
+      if (!dryRun) {
+        pkg.engines = { ...(pkg.engines ?? {}), node: engines }
+        fs.writeFileSync(pkgPath, `${JSON.stringify(pkg, null, 2)}\n`)
+      }
+    }
+  }
+
+  for (const dockerfilePath of findDockerfiles(repoRoot)) {
+    const dockerfile = fs.readFileSync(dockerfilePath, 'utf8')
+    const { content: updatedDockerfile, changed } = syncDockerfileNodeImages(dockerfile, nvmrc, dockerTag)
+    if (changed) {
+      changes.push(`${path.basename(dockerfilePath)}: node base image -> node:${dockerTag ?? resolveDockerNodeTag(nvmrc)}`)
+      if (!dryRun) {
+        fs.writeFileSync(dockerfilePath, updatedDockerfile)
+      }
+    }
+  }
+
+  const jenkinsfilePath = path.join(repoRoot, 'Jenkinsfile')
+  if (fs.existsSync(jenkinsfilePath)) {
+    const jenkinsfile = fs.readFileSync(jenkinsfilePath, 'utf8')
+    const { content: updatedJenkinsfile, changed } = syncJenkinsfileNodeImage(
+      jenkinsfile,
+      jenkinsImage ?? deriveJenkinsImageTag(nvmrc),
+    )
+    if (changed) {
+      changes.push(`Jenkinsfile: jenkins-build image -> ${jenkinsImage ?? deriveJenkinsImageTag(nvmrc)}`)
+      if (!dryRun) {
+        fs.writeFileSync(jenkinsfilePath, updatedJenkinsfile)
+      }
+    }
+  }
+
+  for (const workflowPath of findGithubWorkflows(repoRoot)) {
+    const workflow = fs.readFileSync(workflowPath, 'utf8')
+    const { content: updatedWorkflow, changed } = syncGithubWorkflowNodeVersion(workflow, nvmrc)
+    if (changed) {
+      changes.push(
+        `${path.relative(repoRoot, workflowPath)}: node-version -> ${nvmrc.split('.')[0]}`,
+      )
+      if (!dryRun) {
+        fs.writeFileSync(workflowPath, updatedWorkflow)
+      }
+    }
+  }
+
+  return changes
+}
+
+/**
+ * @param {string} repoRoot
+ * @param {Record<string, unknown>} policy
+ * @param {string} [fgDevkitRoot]
+ * @returns {string[]}
+ */
+export function collectNodeToolchainViolations(repoRoot, policy, fgDevkitRoot) {
+  const nodePolicy = resolveExpectedNodePolicy(policy, fgDevkitRoot)
+  if (!nodePolicy) {
+    return []
+  }
+
+  const violations = []
+  const { nvmrc, engines, jenkinsImage, dockerTag } = nodePolicy
+  const hasRootPackageJson = fs.existsSync(path.join(repoRoot, 'package.json'))
+
+  if (hasRootPackageJson) {
+    const nvmrcPath = path.join(repoRoot, '.nvmrc')
+    if (!fs.existsSync(nvmrcPath)) {
+      violations.push(`.nvmrc: expected ${nvmrc}, got (missing)`)
+    } else {
+      const actual = normalizeNodeVersionLine(fs.readFileSync(nvmrcPath, 'utf8'))
+      if (actual !== nvmrc) {
+        violations.push(`.nvmrc: expected ${nvmrc}, got ${actual}`)
+      }
+    }
+
+    const nodeVersionPath = path.join(repoRoot, '.node-version')
+    if (fs.existsSync(nodeVersionPath)) {
+      const actual = normalizeNodeVersionLine(fs.readFileSync(nodeVersionPath, 'utf8'))
+      if (actual !== nvmrc) {
+        violations.push(`.node-version: expected ${nvmrc}, got ${actual}`)
+      }
+    }
+  }
+
+  if (engines) {
+    for (const pkgPath of findPackageJsonFiles(repoRoot)) {
+      const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf8'))
+      const actual = pkg.engines?.node
+      if (actual !== engines) {
+        violations.push(
+          `${path.relative(repoRoot, pkgPath)} engines.node: expected ${engines}, got ${actual ?? '(missing)'}`,
+        )
+      }
+    }
+  }
+
+  for (const dockerfilePath of findDockerfiles(repoRoot)) {
+    const dockerfile = fs.readFileSync(dockerfilePath, 'utf8')
+    const expectedFrom = `FROM node:${dockerTag ?? resolveDockerNodeTag(nvmrc)}`
+    for (const match of dockerfile.matchAll(/FROM node:(v)?(\d+(?:\.\d+)?)(-[a-z0-9-]+)?/gi)) {
+      if (match[0] !== expectedFrom) {
+        violations.push(
+          `${path.basename(dockerfilePath)}: expected ${expectedFrom}, got ${match[0]}`,
+        )
+      }
+    }
+  }
+
+  const jenkinsfilePath = path.join(repoRoot, 'Jenkinsfile')
+  const expectedJenkins = jenkinsImage ?? deriveJenkinsImageTag(nvmrc)
+  if (fs.existsSync(jenkinsfilePath)) {
+    const jenkinsfile = fs.readFileSync(jenkinsfilePath, 'utf8')
+    const matches = [...jenkinsfile.matchAll(/feelgoodsvenska\/jenkins-build:(node\d+)/g)]
+    for (const match of matches) {
+      if (match[1] !== expectedJenkins) {
+        violations.push(`Jenkinsfile: expected jenkins-build:${expectedJenkins}, got jenkins-build:${match[1]}`)
+      }
+    }
+  }
+
+  const major = nvmrc.split('.')[0]
+  for (const workflowPath of findGithubWorkflows(repoRoot)) {
+    const workflow = fs.readFileSync(workflowPath, 'utf8')
+    for (const match of workflow.matchAll(/node-version:\s*['"]?(\d+(?:\.\d+)?)['"]?/g)) {
+      if (match[1].split('.')[0] !== major) {
+        violations.push(
+          `${path.relative(repoRoot, workflowPath)}: expected node-version ${major}, got ${match[1]}`,
+        )
+      }
+    }
+  }
+
+  return violations
+}

package/scripts/pnpm-toolchain-sync.mjs

@@ -0,0 +1,231 @@
+/**
+ * Sync pnpm packageManager and pnpm@ version pins in a repository.
+ */
+
+import fs from 'node:fs'
+import path from 'node:path'
+
+import { extractPnpmVersion } from './dependency-policy-toolchain.mjs'
+
+const PNPM_AT_VERSION_PATTERN = /pnpm@\d+\.\d+\.\d+(-[\w.]+)?/g
+const PNPM_AT_LATEST_PATTERN = /pnpm@latest/gi
+
+const SKIP_DIR_NAMES = new Set([
+  'node_modules',
+  '.git',
+  'dist',
+  'build',
+  '.next',
+  'coverage',
+  'storybook-static',
+])
+
+/**
+ * @param {string} content
+ * @param {string} pnpmVersion Bare semver (no pnpm@ prefix).
+ * @returns {{ content: string, changed: boolean }}
+ */
+export function syncPnpmVersionInContent(content, pnpmVersion) {
+  const target = `pnpm@${pnpmVersion}`
+  let changed = false
+
+  let updated = content.replace(PNPM_AT_VERSION_PATTERN, (match) => {
+    if (match !== target) {
+      changed = true
+    }
+    return target
+  })
+
+  updated = updated.replace(PNPM_AT_LATEST_PATTERN, () => {
+    changed = true
+    return target
+  })
+
+  return { content: updated, changed }
+}
+
+/**
+ * @param {string} content
+ * @param {string} pnpmVersion
+ * @returns {{ content: string, changed: boolean }}
+ */
+export function syncDockerfilePnpmVersion(content, pnpmVersion) {
+  return syncPnpmVersionInContent(content, pnpmVersion)
+}
+
+/**
+ * @param {string} filePath
+ * @returns {boolean}
+ */
+function shouldScanFileForPnpmPins(filePath) {
+  const base = path.basename(filePath)
+  if (base === 'package.json' || base === 'pnpm-lock.yaml') {
+    return false
+  }
+  if (base === 'Dockerfile' || base === 'Dockerfile.local') {
+    return true
+  }
+  if (base === 'Jenkinsfile') {
+    return true
+  }
+  if (
+    filePath.includes(`${path.sep}.github${path.sep}workflows${path.sep}`) &&
+    /\.(ya?ml)$/i.test(base)
+  ) {
+    return true
+  }
+  return base.endsWith('.sh')
+}
+
+/**
+ * @param {string} dir
+ * @param {string[]} acc
+ * @returns {string[]}
+ */
+function walkRepoFiles(dir, acc = []) {
+  for (const item of fs.readdirSync(dir, { withFileTypes: true })) {
+    if (SKIP_DIR_NAMES.has(item.name)) continue
+    const filePath = path.join(dir, item.name)
+    if (item.isDirectory()) {
+      walkRepoFiles(filePath, acc)
+      continue
+    }
+    acc.push(filePath)
+  }
+  return acc
+}
+
+/**
+ * @param {string} repoDir
+ * @param {string} packageManager
+ * @returns {string[]}
+ */
+export function findPnpmVersionMismatchesInRepo(repoDir, packageManager) {
+  const pnpmVersion = extractPnpmVersion(packageManager)
+  if (!pnpmVersion) {
+    return []
+  }
+
+  const target = `pnpm@${pnpmVersion}`
+  const violations = []
+
+  for (const filePath of walkRepoFiles(repoDir)) {
+    const rel = path.relative(repoDir, filePath).split(path.sep).join('/')
+    const base = path.basename(filePath)
+
+    if (base === 'package.json') {
+      try {
+        const pkg = JSON.parse(fs.readFileSync(filePath, 'utf8'))
+        if (pkg.packageManager !== undefined && pkg.packageManager !== packageManager) {
+          violations.push(`${rel} packageManager: expected ${packageManager}, got ${pkg.packageManager}`)
+        }
+      } catch {
+        // ignore
+      }
+      continue
+    }
+
+    if (!shouldScanFileForPnpmPins(filePath)) {
+      continue
+    }
+
+    const content = fs.readFileSync(filePath, 'utf8')
+    if (!/pnpm@(?:\d+\.\d+\.\d+(?:-[\w.]+)?|latest)/i.test(content)) {
+      continue
+    }
+
+    for (const match of content.matchAll(/pnpm@(?:\d+\.\d+\.\d+(?:-[\w.]+)?|latest)/gi)) {
+      if (match[0] !== target) {
+        violations.push(`${rel}: expected ${target}, got ${match[0]}`)
+      }
+    }
+  }
+
+  return violations
+}
+
+/**
+ * @param {string} repoDir
+ * @param {string} packageManager e.g. pnpm@11.8.0
+ * @param {{ dryRun?: boolean }} [options]
+ * @returns {string[]} change descriptions
+ */
+export function syncPnpmToolchainInRepo(repoDir, packageManager, options = {}) {
+  const { dryRun = false } = options
+  const pnpmVersion = extractPnpmVersion(packageManager)
+  if (!pnpmVersion) {
+    throw new Error(`Invalid packageManager: ${packageManager}`)
+  }
+
+  const changes = []
+
+  for (const filePath of walkRepoFiles(repoDir)) {
+    const rel = path.relative(repoDir, filePath).split(path.sep).join('/')
+    const base = path.basename(filePath)
+
+    if (base === 'package.json') {
+      let pkg
+      try {
+        pkg = JSON.parse(fs.readFileSync(filePath, 'utf8'))
+      } catch {
+        continue
+      }
+      if (pkg.packageManager !== undefined && pkg.packageManager !== packageManager) {
+        changes.push(`${rel} packageManager: ${pkg.packageManager} -> ${packageManager}`)
+        if (!dryRun) {
+          pkg.packageManager = packageManager
+          fs.writeFileSync(filePath, `${JSON.stringify(pkg, null, 2)}\n`)
+        }
+      }
+      continue
+    }
+
+    if (!shouldScanFileForPnpmPins(filePath)) {
+      continue
+    }
+
+    const content = fs.readFileSync(filePath, 'utf8')
+    if (!/pnpm@(?:\d+\.\d+\.\d+(?:-[\w.]+)?|latest)/i.test(content)) {
+      continue
+    }
+
+    const { content: updated, changed } = syncPnpmVersionInContent(content, pnpmVersion)
+    if (changed) {
+      changes.push(`${rel}: pnpm -> ${pnpmVersion}`)
+      if (!dryRun) {
+        fs.writeFileSync(filePath, updated)
+      }
+    }
+  }
+
+  return changes
+}
+
+/**
+ * @param {Record<string, unknown>} pkg
+ * @returns {boolean}
+ */
+export function isVueFgDevkitConsumerPackage(pkg) {
+  if (!pkg || pkg.name === 'fg-devkit') {
+    return false
+  }
+  const hasVue = Boolean(pkg.dependencies?.vue || pkg.devDependencies?.vue)
+  const hasFgDevkit = Boolean(pkg.dependencies?.['fg-devkit'] || pkg.devDependencies?.['fg-devkit'])
+  return hasVue && hasFgDevkit
+}
+
+/**
+ * @param {string} repoDir
+ * @returns {boolean}
+ */
+export function isVueFgDevkitConsumerRepo(repoDir) {
+  const pkgPath = path.join(repoDir, 'package.json')
+  if (!fs.existsSync(pkgPath)) {
+    return false
+  }
+  try {
+    return isVueFgDevkitConsumerPackage(JSON.parse(fs.readFileSync(pkgPath, 'utf8')))
+  } catch {
+    return false
+  }
+}

package/scripts/scaffold-vue.mjs

@@ -10,7 +10,7 @@
  *   --slug <string>              package.json name / slug (default: my-app)
  *   --docker-image <string>      Docker registry image without tag (default: myorg/my-app-ui)
  *   --jenkins-library <string>   Jenkins shared library name (default: my-shared-library)
- *   --jenkins-node-image <string> CI Docker image for Node (default: node:22-bookworm)
+ *   --jenkins-node-image <string> CI Docker image for Node (default: node:22-alpine)
  *   --jenkins-docker-label <string> Jenkins label for docker-build agents (default: docker)
  *   --jenkins-registry-cred <string> Jenkins credentialsId for Docker registry (default: docker-registry)
  *   --jenkins-poeditor-cred <string> Jenkins credentialsId for POEditor API key (default: poeditor_api_key)
@@ -146,7 +146,7 @@ function main() {
   const slug = flags.get('slug') ?? 'my-app'
   const dockerImage = flags.get('docker-image') ?? 'myorg/my-app-ui'
   const jenkinsLibrary = flags.get('jenkins-library') ?? 'my-shared-library'
-  const jenkinsNodeImage = flags.get('jenkins-node-image') ?? 'node:22-bookworm'
+  const jenkinsNodeImage = flags.get('jenkins-node-image') ?? 'node:22-alpine'
   const jenkinsDockerLabel = flags.get('jenkins-docker-label') ?? 'docker'
   const jenkinsRegistryCred = flags.get('jenkins-registry-cred') ?? 'docker-registry'
   const jenkinsPoeditorCred = flags.get('jenkins-poeditor-cred') ?? 'poeditor_api_key'

package/scripts/sync-dependency-policy.mjs

@@ -4,7 +4,7 @@
  *
  * Only updates keys that already exist in package.json (does not add new dependencies from the policy).
  * Aligns managedDependencies, managedAnywhere (only where the package is already declared), optional
- * policy overrides into pnpm.overrides, toolchain.packageManager into package.json, and logs each change.
+ * policy overrides into pnpm.overrides, toolchain fields (packageManager, Node), and logs each change.
  *
  * Refuses to run if the policy file contains any non-pinned versions.
  *
@@ -17,15 +17,19 @@ import { fileURLToPath } from 'node:url'
 
 import { collectPinViolations } from './dependency-policy-pins.mjs'
 import {
+  collectNodeToolchainPolicyViolations,
   collectToolchainPolicyViolations,
   resolveExpectedPackageManager,
 } from './dependency-policy-toolchain.mjs'
+import { syncNodeToolchainInRepo } from './node-toolchain-sync.mjs'
+import { syncPnpmToolchainInRepo } from './pnpm-toolchain-sync.mjs'
 import { resolveDependencyPolicyPath } from './resolve-dependency-policy-path.mjs'
 
 const cwd = process.cwd()
 const pkgPath = path.resolve(cwd, 'package.json')
 const lockfilePath = path.resolve(cwd, 'pnpm-lock.yaml')
 const scriptDir = path.dirname(fileURLToPath(import.meta.url))
+const fgDevkitRoot = path.resolve(scriptDir, '..')
 const policyPath = resolveDependencyPolicyPath(scriptDir, cwd, process.argv)
 
 if (!fs.existsSync(pkgPath)) {
@@ -49,6 +53,7 @@ const policyErrors = [
   ),
   ...collectPinViolations('managedAnywhere.', policy.managedAnywhere ?? {}),
   ...collectToolchainPolicyViolations(policy),
+  ...collectNodeToolchainPolicyViolations(policy),
 ]
 
 if (policyErrors.length > 0) {
@@ -130,30 +135,57 @@ for (const [name, version] of Object.entries(policy.managedAnywhere ?? {})) {
   }
 }
 
-pkg.pnpm ||= {}
-pkg.pnpm.overrides ||= {}
-
 // Apply policy-defined override versions when present in the policy.
-for (const [name, version] of Object.entries(getRelevantPolicyOverrides(policy.overrides ?? {}))) {
-  if (pkg.pnpm.overrides[name] !== version) {
-    changes.push(`pnpm.overrides.${name}: ${pkg.pnpm.overrides[name] ?? '(missing)'} -> ${version}`)
-    pkg.pnpm.overrides[name] = version
+const relevantOverrides = getRelevantPolicyOverrides(policy.overrides ?? {})
+for (const [name, version] of Object.entries(relevantOverrides)) {
+  if (pkg.pnpm?.overrides?.[name] === version) {
+    continue
   }
+  pkg.pnpm ??= {}
+  pkg.pnpm.overrides ??= {}
+  changes.push(`pnpm.overrides.${name}: ${pkg.pnpm.overrides[name] ?? '(missing)'} -> ${version}`)
+  pkg.pnpm.overrides[name] = version
 }
 
-const expectedPackageManager = resolveExpectedPackageManager(policy, path.resolve(scriptDir, '..'))
+const expectedPackageManager = resolveExpectedPackageManager(policy, fgDevkitRoot)
 if (expectedPackageManager !== undefined && pkg.packageManager !== expectedPackageManager) {
   changes.push(`packageManager: ${pkg.packageManager ?? '(missing)'} -> ${expectedPackageManager}`)
   pkg.packageManager = expectedPackageManager
 }
 
-if (changes.length === 0) {
-  console.log('[sync-deps] package.json already matches dependency policy')
+if (changes.length > 0) {
+  fs.writeFileSync(pkgPath, `${JSON.stringify(pkg, null, 2)}\n`)
+}
+
+const nodeToolchainChanges = syncNodeToolchainInRepo(cwd, policy, { fgDevkitRoot })
+
+let pnpmToolchainChanges = []
+if (expectedPackageManager !== undefined) {
+  pnpmToolchainChanges = syncPnpmToolchainInRepo(cwd, expectedPackageManager)
+}
+
+if (changes.length === 0 && nodeToolchainChanges.length === 0 && pnpmToolchainChanges.length === 0) {
+  console.log('[sync-deps] package.json and toolchain already match dependency policy')
   process.exit(0)
 }
 
-fs.writeFileSync(pkgPath, `${JSON.stringify(pkg, null, 2)}\n`)
-console.log('[sync-deps] Updated package.json to match dependency policy')
-for (const change of changes) {
-  console.log(`- ${change}`)
+if (changes.length > 0) {
+  console.log('[sync-deps] Updated package.json to match dependency policy')
+  for (const change of changes) {
+    console.log(`- ${change}`)
+  }
+}
+
+if (nodeToolchainChanges.length > 0) {
+  console.log('[sync-deps] Updated Node toolchain files')
+  for (const change of nodeToolchainChanges) {
+    console.log(`- ${change}`)
+  }
+}
+
+if (pnpmToolchainChanges.length > 0) {
+  console.log('[sync-deps] Updated pnpm toolchain files')
+  for (const change of pnpmToolchainChanges) {
+    console.log(`- ${change}`)
+  }
 }