[rush] ensureConsistentVersions is not working

[elliot-nelson]

Summary

My expectation is that if ensureConsistentVersions is turned on, then rush check should never fail if rush install succeeds. Conversely, rush install should never fail if rush check does not fail. At some point, this expectation stopped being true.

Repro steps

In common-versions.json, add the following:

  "ensureConsistentVersions": true,
  "allowedAlternativeVersions": {
    "@firebolt-js/sdk": ["1.0.0"]
  }
}

Then in two packages (A and B), add the following dependencies: @firebolt-js/sdk@^0.8.1 (for Package A) and @firebolt-js/[email protected] (for Package B).

Now, run rush update. The command succeeds successfully, even though I expect it to fail, because the versions are not consistent, and neither of them are in the list of allowed alternative versions.

Then, run rush check. I expect this to succeed, because it should never fail if rush update succeeds, but it does fail, printing out the two versions of the dependency.

Details

I'm not sure when this changed, but as-is it's a big problem, because rush check is part of the rush publish pipeline, so the end result is you merge seemingly valid PRs to main, then your publishing job fails when you try to publish packages.

Standard questions

Please answer these questions to help us investigate your issue more quickly:

Question	Answer
@microsoft/rush globally installed version?	5.141.3
rushVersion from rush.json?	5.141.3
useWorkspaces from rush.json?	true
Operating system?	Mac
Would you consider contributing a PR?	Maybe
Node.js version (node -v)?	20.18.1