[rush] Implement rush-pnpm approve-builds to persist globalOnlyBuiltDependencies

[Copilot]

Implementation Complete: rush-pnpm approve-builds

This PR implements support for the rush-pnpm approve-builds command to properly update common/config/rush/pnpm-config.json, resolving the issue where warnings about ignored build scripts persist after running the command.

Changes Implemented

✅ All tasks completed:

• 1. Add approve-builds command handling in RushPnpmCommandLineParser.ts

  • Version validation (requires pnpm >= 10.1.0)
  • Post-execution handling to update pnpm-config.json
  • Use async JSON loading

• 2. Add updateGlobalOnlyBuiltDependencies() method in PnpmOptionsConfiguration.ts

• 3. Add output rewriting during install to replace pnpm approve-builds with rush-pnpm approve-builds

  • Refactored to eliminate code duplication (DRY)

• 4. Testing

  • Built successfully
  • All 29 tests passed
  • API file updated
  • Linter warnings fixed

• 5. Add changelog entry

  • Created change file for @microsoft/rush package

• 6. Address code review feedback

  • Eliminated duplicate code in WorkspaceInstallManager.ts
  • Changed JsonFile.load to JsonFile.loadAsync in RushPnpmCommandLineParser.ts

Files Modified (5 files, +94 lines, -19 lines)

1. RushPnpmCommandLineParser.ts (+63 lines)

   • Added validation for approve-builds command requiring pnpm >= 10.1.0
   • Added post-execution handler that reads pnpm.onlyBuiltDependencies from temp package.json
   • Updates globalOnlyBuiltDependencies in pnpm-config.json and runs rush update
   • Uses async JSON loading for better performance

2. PnpmOptionsConfiguration.ts (+10 lines)

   • Added updateGlobalOnlyBuiltDependencies() method to save changes to pnpm-config.json

3. WorkspaceInstallManager.ts (+19 lines, -19 lines)

   • Modified onPnpmStdoutChunk to rewrite pnpm approve-builds → rush-pnpm --subspace <name> approve-builds
   • Refactored to eliminate code duplication (consolidated both branches into one function)
   • Ensures users are instructed to use the correct Rush command

4. rush-lib.api.md (+1 line)

   • Updated API documentation for public method

5. common/changes/@microsoft/rush/approve-builds_2026-01-26-21-57.json (new file)

   • Added changelog entry for the new feature

How It Works

The implementation follows the same pattern as rush-pnpm patch-commit:

1. User runs: rush-pnpm approve-builds
2. Validation: Rush checks pnpm version >= 10.1.0 and ensures pnpm-config.json exists
3. Execution: pnpm approve-builds runs normally, updating common/temp/package.json
4. Post-processing: Rush detects changes in pnpm.onlyBuiltDependencies and:
   • Updates globalOnlyBuiltDependencies in common/config/rush/pnpm-config.json
   • Runs rush update to refresh the shrinkwrap file
   • Prompts user to commit changes
5. Next rush update: Warning no longer appears because approved packages are in config

Testing

• ✅ Built rush-lib project successfully
• ✅ All 29 tests passed (including @microsoft/rush-lib tests)
• ✅ No linter warnings
• ✅ API documentation updated automatically

Resolves

• Issue: rush-pnpm approve-builds should update common/config/rush/pnpm-config.json
• Referenced in issue [rush] Rush/pnpm is bugging me about ignored build scripts after every rush update #5542

Original prompt

---

This section details on the original issue you should resolve

<issue_title>[rush] rush-pnpm approve-builds should update common/config/rush/pnpm-config.json</issue_title>
<issue_description>## Summary

rush-pnpm approve-builds does not update common/config/rush/pnpm-config.json, which means the user is presented with the same warning on every rush update.

Repro steps

1. Upgrade to the latest version of Node and pnpm
2. Run rush update in a repo where dependencies have build scripts
3. See the warning about "Ignored build scripts"
4. Run rush-pnpm approve-builds and approve the dependencies
5. Run rush update again
6. See that the warning still appears

Expected result: Warning should go away

Actual result: Warning continues to appear

Details

See #5542 also.

Standard questions

Please answer these questions to help us investigate your issue more quickly:

Question	Answer
@microsoft/rush globally installed version?	5.165.0
rushVersion from rush.json?	5.165.0
pnpmVersion, npmVersion, or yarnVersion from rush.json?	pnpm@10.27.0
(if pnpm) useWorkspaces from pnpm-config.json?	true
Operating system?	Windows 11
Would you consider contributing a PR?	No
Node.js version (node -v)?	24.12.0
</issue_description>

Comments on the Issue (you are @copilot in this section)

@iclanton Two things should happen here: 1. We should rewrite the message that appears during install to instruct the user to use `rush-pnpm approve-builds` instead of `pnpm approve-builds` (similar to how we rewrite output from `rush-pnpm patch` to instruct the user to use `rush-pnpm patch-commit`) 2. Handle that command here: https://github.com/microsoft/rushstack/blob/275c3f5c9f3d7dd951161d7a96903e5bebcab7b8/libraries/rush-lib/src/cli/RushPnpmCommandLineParser.ts#L259-L399. Again, this should be similar to our handling of `rush-pnpm patch-commit` to update the `common/config/rush/pnpm-config.json` file.

• Fixes [rush] rush-pnpm approve-builds should update common/config/rush/pnpm-config.json #5543

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

[iclanton]

@copilot - This needs a changelog entry.

[Copilot]

@copilot - This needs a changelog entry.

Added changelog entry in commit 106860a.