Skip to content

ci: use reproducible npm installs - #6

Open
DorianChn wants to merge 1 commit into
mainfrom
codex/ci-reproducible-install
Open

DorianChn wants to merge 1 commit into
mainfrom
codex/ci-reproducible-install

Conversation

@DorianChn

Copy link
Copy Markdown
Owner

Summary

  • replace
    pm install with
    pm ci in the GitHub Actions workflow

Why

The repository commits package-lock.json, so CI should install the exact locked dependency graph. This prevents the workflow from silently resolving a different dependency tree than local development.

Validation

pm ci --no-fund --no-audit

pm test (59 passed)

pm run typecheck

pm run build

  • git diff --check
  • scanned the changed workflow for credentials and found none

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant