ci: modernize node setup and pin npm for reproducible installs#887
Merged
Conversation
✅ Deploy Preview for volview-dev ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
Upgrade actions/setup-node v1 to v4 on Node 22 with npm caching in checks.yml, and add an explicit setup-node step to e2e.yml so the e2e job is pinned to Node 22 instead of floating with the runner default. Pin the package manager with "packageManager": "npm@10.9.8" so CI, local dev, and Dependabot all resolve package-lock.json with the same npm. This is what Dependabot was missing: it regenerated the lock with a different npm, dropping nested subtrees that `npm ci` then rejected.
- fast-uri 3.1.1 -> 3.1.2 (Kitware#875) - @babel/plugin-transform-modules-systemjs 7.29.0 -> 7.29.7 (Kitware#876) - js-cookie 3.0.5 -> 3.0.8 (Kitware#882) - qs 6.15.1 -> 6.15.2 (Kitware#883) - tmp 0.2.5 -> 0.2.7 (Kitware#884)
PaulHax
force-pushed
the
ci-modernize-deps
branch
from
015b826 to
6159a84
Compare
PaulHax
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
actions/setup-nodev1 → v4 (Node 22, npm caching) inchecks.yml.setup-nodestep toe2e.ymlso the e2e job is pinned to Node 22 instead of floating with the runner default."packageManager": "npm@10.9.8".Why
The Dependabot PRs were all failing
npm ci("Missing: chokidar from lock file"). Root cause: Dependabot regeneratedpackage-lock.jsonwith a different npm than the one that produced main's lock, dropping nested subtrees thatnpm cithen rejected.mainitself was fine.Pinning
packageManagermakes CI, local dev, and Dependabot resolve the lock with the same npm (10.9.8), so future Dependabot updates stay consistent. No corepack needed: plain npm ignores the field, Dependabot reads it.The
setup-nodev1 → v4 bump also clears the deprecation warning (v1 ran on the now-removed Node 20 actions runtime). Pinning e2e to Node 22 guards against the runner default later moving to Node 24, which breaks the wdio e2e worker bootstrap.Closes the need for #875, #876, #882, #883, #884.