create-app: add a yarn.lock seed file

[Rugvip]

Hey, I just made a Pull Request!

This adds seed-yarn.lock to packages/create-app, which is downloaded and used as the initial yarn.lock for all projects created with @backstage/create-app. The purpose of this is for us to be able to lock individual dependency version ranges to older versions, in the event that the latest release of those dependencies is broken.

The file is not bundled with the @backstage/create-app package itself in order for us to not have to publish new versions every time we update that file, as that would disrupt our release process quite a lot. Even with patch releases we'd need to keep the file in sync in master as well since we don't want broken e2e tests. If the downloading turns out to be a big issue I think it's something we could consider though.

Noting that the seed-yarn.lock uses the Yarn v1 lockfile format, but later versions are able to translate that during the install, so our E2E tests that use Yarn v3 currently still pick up the initial lockfile entries.

For the e2e tests the seed-yarn.lock in the workspace is used instead, so that changes to the file are immediately visible in CI.

This also fixes our E2E tests, which are currently broken by testing-library/jest-dom#574

This is what it looks like if @backstage/create-app fails to download the seed file:

✔️ Checklist

• A changeset describing the change and affected packages. (more info)
• Added or updated documentation
• Tests for new functionality and regression tests for bug fixes
• Screenshots attached (for UI changes)
• All your commits have a Signed-off-by line in the message. (more info)

[backstage-goalie]

Changed Packages

Package Name	Package Path	Changeset Bump	Current Version
@backstage/create-app	packages/create-app	patch	v0.5.11-next.1
e2e-test	packages/e2e-test	none	v0.2.12-next.1

[github-actions]

Uffizzi Cluster pr-22659 was deleted.

[freben]

Yep nice!

We should starting msw 2 btw, it's really much nicer.

[github-actions]

Thank you for contributing to Backstage! The changes in this pull request will be part of the 1.23.0 release, scheduled for Tue, 20 Feb 2024.

[awanlin]

This is great, many thanks @Rugvip!

Just have some over all comments:

• Do we have any documentation as to how we would update this file once we hit a case where we have a broken package?
• For those using a private registry will that still work?
  - Will this be easy to port to Yarn 3 (or 4)?

[Rugvip]

@awanlin it's documented in the seed file itself: https://github.com/backstage/backstage/blob/master/packages/create-app/seed-yarn.lock

Afaik the behavior for private registries is that they'll end up with the individual registry.yarnpkg.com entries in their yarn.lock, which can be rewritten if desired. If the registry is not reachable at all then yarn install may fail, and at that point I'm hoping there's a clear enough error about the existing entry, but definitely something to keep an eye on.

[awanlin]

Thanks @Rugvip , totally missed the commends in that file!