SRVKP-12826: updated enable corepack in refresh-yarn-lockfile workflow

[arvindk-softwaredev]

Type of Change

• Bug fix
• New feature
• Refactoring
• Migration
• CVE Fix

Summary

Updated Refresh yarn lockfile github workflow with Enable Corepack step

[openshift-ci-robot]

@arvindk-softwaredev: This pull request references SRVKP-12826 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the vulnerability to target the "5.0.0" version, but no target version was set.

Details

In response to this:

Type of Change

• Bug fix
• New feature
• Refactoring
• Migration
• CVE Fix

Summary

Updated Refresh yarn lockfile github workflow with Enable Corepack step

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[qodo-code-review]

PR Reviewer Guide 🔍

Warning

/review is deprecated. Use /agentic_review instead (removal date not yet scheduled).

Here are some key observations to aid the review process:

⏱️ Estimated effort to review: 1 🔵⚪⚪⚪⚪

🧪 No relevant tests

🔒 Security concerns Supply-chain risk: npm install -g corepack downloads and executes an unpinned package version in the GitHub Actions runner. Pin corepack to a reviewed version to make the CVE remediation reproducible and limit exposure to unexpected upstream releases.

⚡ Recommended focus areas for review Unpinned Dependency Installing corepack without a version makes workflow behavior depend on the latest npm release and may unexpectedly introduce incompatible or compromised code. Pin a reviewed Corepack version. run: npm install -g corepack; \ corepack enable ;\ corepack prepare yarn@4.6.0 --activate; \

[anwesha-palit-redhat]

/lgtm

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: anwesha-palit-redhat, arvindk-softwaredev

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [anwesha-palit-redhat,arvindk-softwaredev]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment