[richerfu]

Problem

The Release-plz PR job fails on every push to main:

ERROR failed to update packages
Caused by:
  0: failed to determine next versions
  1: the working directory of this project has uncommitted changes.
     Please commit or stash these changes:
     ["demo/entry/oh-package-lock.json5", "plugins/accessibility/oh-package-lock.json5", ... 22 files]

The 1.0.0-beta.4 release (#113) bumped native_ability and nine plugin HAR manifests but did not regenerate their oh-package-lock.json5 files. The pnpm install step runs the postinstall hook (scripts/install-ohpm.js → ohpm-rs install --all), which rewrites all 22 lockfiles to record the new versions. release-plz then refuses to run on a dirty tree, so no new release PR is created.

Changes

• Regenerate the 22 committed lockfiles. The diff is limited to 31 version fields (1.0.0-beta.3 → 1.0.0-beta.4); lock structure is unchanged.
• scripts/sync-release.js: after ohpm-rs version bumps the manifests, refresh the lockfiles before formatting, so the release PR carries the lock update and the next CI install is a no-op.
• Pin ohpm-cli to the just-released 0.5.0 through a new scripts/ensure-ohpm.js:
  • cargo install refuses to replace a different installed version without --force, so a bare pin bump would break pnpm install for anyone upgrading from 0.3.0/0.4.0. The script checks ohpm-rs --version and only reinstalls (with --force) on a mismatch.
  • The release workflow uses the same script instead of a second hardcoded version pin.
• Release sync now refreshes locks with ohpm-rs install --lockfile-only (added in ohpm-rs 0.5.0) instead of a full install: resolution only, no tarball downloads, no oh_modules or manifest writes.
• README/README.zh-CN: update the pinned version and drop the now-stale "0.3.0 Unix-only linking blocks Windows" claim (native Windows remains unvalidated here).

Verification

• Reproduced the exact dirty set on a scratch worktree: ohpm-rs install --all updates only the version fields in the 22 lockfiles; a second install is a no-op.
• Verified the published ohpm-cli 0.5.0 binary exposes --lockfile-only; its output on a clean workspace snapshot is byte-identical to a full install.
• node scripts/install-ohpm.js --lockfile-only leaves the working tree clean (no lock changes, no oh_modules).
• scripts/ensure-ohpm.js: with 0.4.0 on PATH it runs cargo install ... --force; with 0.5.0 it exits without invoking cargo.
• node scripts/sync-release.js --dry-run runs cleanly; ohpm-rs version alone does not update lockfiles.

🤖 Generated with Claude Code