fix(ci): replace npm install with npm ci for reproducible builds (closes #375)

[shadrackmanfred]

Summary

Closes #375. The CI workflow used npm install for all packages, which can silently update package-lock.json during CI and produce non-reproducible builds. This PR replaces every npm install with npm ci (or the pnpm equivalent) so every CI run installs the exact dependency tree from the committed lockfile.

Changes

.github/workflows/ci.yml

Before	After	Reason
npm install (root)	npm ci	Root has package-lock.json — npm ci installs exact versions
cd api && npm install	cd api && npm ci	API has its own package-lock.json
cd xstreamroll-processing && npm install	pnpm install --frozen-lockfile	Processing uses pnpm (pnpm-lock.yaml). npm install was ignoring it, making those installs non-reproducible
cd packages/types && npm install && npm run build	cd packages/types && npm run build	Root npm ci (via workspaces) already installs types deps
cd app && npm install	(removed)	Covered by root workspace install
cd xstreamroll-sdk && npm install	(removed)	Covered by root workspace install
(missing)	npm install -g pnpm	Installs pnpm on the runner before processing install
(missing)	git diff --exit-code	Fails CI if any lockfile was modified

Same pattern applied to the bundle-analysis job.

Testing

• YAML validates cleanly
• Lockfile check covers package-lock.json, api/package-lock.json, and xstreamroll-processing/pnpm-lock.yaml

Acceptance Criteria (from #375)

• All npm install commands in CI replaced with npm ci
• Processing package uses pnpm install --frozen-lockfile for reproducible pnpm installs
• Lockfile integrity check: CI fails if any lockfile is modified by the install step

[Xhristin3]

Thanks @shadrackmanfred for tightening the CI install path. Merged.

[Xhristin3]

Quick correction — my automated merge attempt actually hit a conflict with code that landed earlier in this batch, so this one is not merged yet. Leaving it open so you can rebase onto main when convenient. Apologies for the noise.

[Xhristin3]

Hi @shadrackmanfred — thanks for the durable-builds work. I attempted a maintainer-side carry-forward but the conflict on .github/workflows/ci.yml is structural, not text-level: your branch removes the postgres service, switches xstreamroll-processing to pnpm, drops the new tests/contracts build/lint/typecheck steps entirely, and adds a Verify lockfiles are up-to-date step — but main has since landed #419 (which adds the contracts package to workspaces, build, lint, and typecheck pipeline), #463 (CI infra things), and the bundle-analysis job grew. Applying your wholesale refactor on top of current main would silently wipe out the contract-tests gate that just got added, and pnpm for xstreamroll-processing would split installs across two lockfile families. So I’m punting this one back to you for a careful rebase rather than risking a destructive auto-merge. Concrete steps:

1. git fetch origin main && git checkout feature/resolve-pr-459-bump-or-whatever && git rebase origin/main
2. On .github/workflows/ci.yml keep main’s current structure (postgres service, contract-tests install + lint + typecheck, bundle-analysis job).
3. Re-apply only the swap npm install -> npm ci for install-only steps, leaving the existing chained npm install && npm run build lines functioning (splitting that to npm ci && npm run build is fine but not required).
4. If you still want the Verify lockfiles are up-to-date step, add it as a new step right before the bundle-analysis upload block — don’t put it in place of anything.
5. The tests/contracts workspace gets a package-lock.json contribution too, so let npm install re-resolve it.
6. git push -f origin HEAD — I can’t push to your branch (maintainer-edits is disabled), but once you push we’ll merge.

If you’d rather I open a maintainer carry-forward PR with only the npm install -> npm ci swap (and skip the rest of your diff for safety), say the word and I’ll do it in 5 minutes.

— Xhristin3