From f5b1ad6031d2b130c536f3d405c8d182dddddf22 Mon Sep 17 00:00:00 2001
From: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Date: Mon, 20 Oct 2025 17:34:56 +0000
Subject: [PATCH 1/5] Use .nvmrc for Node version in CI/CD workflows and npm
 install in post-checkout hook

- Update all workflow files (ci.yml, package.yml, deps.yml, copilot-setup-steps.yml) to use node-version-file: '.nvmrc' instead of hardcoded NODE_VERSION
- Remove NODE_VERSION environment variable from workflow files
- Change post-checkout hook from npm ci to npm install for local development
- All CI workflows continue to use npm ci as expected
---
 .github/workflows/ci.yml                  | 17 +++++++----------
 .github/workflows/copilot-setup-steps.yml |  5 ++---
 .github/workflows/deps.yml                |  7 ++-----
 .github/workflows/package.yml             |  5 +----
 .husky/post-checkout                      |  2 +-
 5 files changed, 13 insertions(+), 23 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d75b56b138..7e35d45a1e 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -7,9 +7,6 @@ on:
     branches: [main]
   workflow_dispatch:
 
-env:
-  NODE_VERSION: 22.x
-
 permissions:
   actions: read
   contents: read
@@ -32,7 +29,7 @@ jobs:
         uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v5
         with:
           cache: 'npm'
-          node-version: ${{ env.NODE_VERSION }}
+          node-version-file: '.nvmrc'
           registry-url: 'https://npm.pkg.github.com'
           scope: '@deepnote'
 
@@ -59,7 +56,7 @@ jobs:
         uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v5
         with:
           cache: 'npm'
-          node-version: ${{ env.NODE_VERSION }}
+          node-version-file: '.nvmrc'
           registry-url: 'https://npm.pkg.github.com'
           scope: '@deepnote'
 
@@ -105,7 +102,7 @@ jobs:
         uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v5
         with:
           cache: 'npm'
-          node-version: ${{ env.NODE_VERSION }}
+          node-version-file: '.nvmrc'
           registry-url: 'https://npm.pkg.github.com'
           scope: '@deepnote'
 
@@ -155,7 +152,7 @@ jobs:
         uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v5
         with:
           cache: 'npm'
-          node-version: ${{ env.NODE_VERSION }}
+          node-version-file: '.nvmrc'
           registry-url: 'https://npm.pkg.github.com'
           scope: '@deepnote'
 
@@ -179,7 +176,7 @@ jobs:
         uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
         with:
           cache: 'npm'
-          node-version: ${{ env.NODE_VERSION }}
+          node-version-file: '.nvmrc'
           registry-url: 'https://npm.pkg.github.com'
           scope: '@deepnote'
 
@@ -203,7 +200,7 @@ jobs:
         uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v5
         with:
           cache: 'npm'
-          node-version: ${{ env.NODE_VERSION }}
+          node-version-file: '.nvmrc'
           registry-url: 'https://npm.pkg.github.com'
           scope: '@deepnote'
 
@@ -227,7 +224,7 @@ jobs:
         uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v5
         with:
           cache: 'npm'
-          node-version: ${{ env.NODE_VERSION }}
+          node-version-file: '.nvmrc'
           registry-url: 'https://npm.pkg.github.com'
           scope: '@deepnote'
 
diff --git a/.github/workflows/copilot-setup-steps.yml b/.github/workflows/copilot-setup-steps.yml
index 4a10d5aed8..26ff655a96 100644
--- a/.github/workflows/copilot-setup-steps.yml
+++ b/.github/workflows/copilot-setup-steps.yml
@@ -12,7 +12,6 @@ on:
       - .github/workflows/copilot-setup-steps.yml
 
 env:
-  NODE_VERSION: 22.15.1
   NPM_VERSION: 10.9.2
   PYTHON_VERSION: 3.12
   DENO_VERSION: '~1.37'
@@ -39,10 +38,10 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
 
-      - name: Use Node ${{env.NODE_VERSION}}
+      - name: Setup Node.js
         uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v5
         with:
-          node-version: ${{env.NODE_VERSION}}
+          node-version-file: '.nvmrc'
           registry-url: 'https://npm.pkg.github.com'
           scope: '@deepnote'
 
diff --git a/.github/workflows/deps.yml b/.github/workflows/deps.yml
index 1ac599eb77..b1a1a8b2dc 100644
--- a/.github/workflows/deps.yml
+++ b/.github/workflows/deps.yml
@@ -6,9 +6,6 @@ on:
     - cron: '0 9 * * 1'
   workflow_dispatch:
 
-env:
-  NODE_VERSION: 22.x
-
 permissions:
   actions: read
   contents: read
@@ -30,7 +27,7 @@ jobs:
         uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v5
         with:
           cache: 'npm'
-          node-version: ${{ env.NODE_VERSION }}
+          node-version-file: '.nvmrc'
           registry-url: 'https://npm.pkg.github.com'
           scope: '@deepnote'
 
@@ -62,7 +59,7 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v5
         with:
-          node-version: ${{ env.NODE_VERSION }}
+          node-version-file: '.nvmrc'
           cache: 'npm'
 
       - name: Install dependencies
diff --git a/.github/workflows/package.yml b/.github/workflows/package.yml
index 90b7c992cb..c920d1fa7f 100644
--- a/.github/workflows/package.yml
+++ b/.github/workflows/package.yml
@@ -7,9 +7,6 @@ on:
     branches: [main]
   workflow_dispatch:
 
-env:
-  NODE_VERSION: 22.x
-
 permissions:
   contents: read
   packages: read
@@ -31,7 +28,7 @@ jobs:
         uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
         with:
           cache: 'npm'
-          node-version: ${{ env.NODE_VERSION }}
+          node-version-file: '.nvmrc'
           registry-url: 'https://npm.pkg.github.com'
           scope: '@deepnote'
 
diff --git a/.husky/post-checkout b/.husky/post-checkout
index 385cb3aa69..5fdd18ffd2 100755
--- a/.husky/post-checkout
+++ b/.husky/post-checkout
@@ -1 +1 @@
-npm ci
+npm install

From e40fffb9c7bc531bef12fd61462113a129347b8a Mon Sep 17 00:00:00 2001
From: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Date: Mon, 20 Oct 2025 19:02:01 +0000
Subject: [PATCH 2/5] Update npm ci to npm install everywhere except CI
 workflow files

Changes:
- Updated CD workflow (package.yml) to use npm install
- Updated deps workflow (deps.yml) to use npm install
- Updated copilot-setup-steps workflow to use npm install
- Updated GitHub actions (npm-ci, build-vsix) to use npm install
- Updated Azure pipeline files (stable, pre-release) to use npm install
- Updated devcontainer files to use npm install in comments
- CI workflow files (ci.yml) continue to use npm ci as expected

This ensures npm ci is only used in CI environments where reproducible builds are critical, while npm install is used everywhere else for flexibility.
---
 .devcontainer/dev-with-python/devcontainer.json | 2 +-
 .devcontainer/dev/devcontainer.json             | 2 +-
 .github/actions/build-vsix/action.yml           | 4 ++--
 .github/actions/npm-ci/action.yml               | 4 ++--
 .github/workflows/copilot-setup-steps.yml       | 6 +++---
 .github/workflows/deps.yml                      | 4 ++--
 .github/workflows/package.yml                   | 2 +-
 build/azure-pipeline.pre-release.yml            | 4 ++--
 build/azure-pipeline.stable.yml                 | 4 ++--
 9 files changed, 16 insertions(+), 16 deletions(-)

diff --git a/.devcontainer/dev-with-python/devcontainer.json b/.devcontainer/dev-with-python/devcontainer.json
index c4521197f8..e954d107a9 100644
--- a/.devcontainer/dev-with-python/devcontainer.json
+++ b/.devcontainer/dev-with-python/devcontainer.json
@@ -33,7 +33,7 @@
 
     "mounts": ["source=${localWorkspaceFolder},target=/workspaces/local,type=bind,consistency=cached"],
     // Use 'postCreateCommand' to run commands after the container is created.
-    // "postCreateCommand": "npm ci",
+    // "postCreateCommand": "npm install",
     // Comment out connect as root instead. More info: https://aka.ms/vscode-remote/containers/non-root.
     "remoteUser": "vscode"
 }
diff --git a/.devcontainer/dev/devcontainer.json b/.devcontainer/dev/devcontainer.json
index b6604a3267..b9973f6fcf 100644
--- a/.devcontainer/dev/devcontainer.json
+++ b/.devcontainer/dev/devcontainer.json
@@ -19,7 +19,7 @@
     },
     "mounts": ["source=${localWorkspaceFolder},target=/workspaces/local,type=bind,consistency=cached"]
     // Use 'postCreateCommand' to run commands after the container is created.
-    // "postCreateCommand": "npm ci",
+    // "postCreateCommand": "npm install",
     // Comment out connect as root instead. More info: https://aka.ms/vscode-remote/containers/non-root.
     // , "remoteUser": "vscode"
 }
diff --git a/.github/actions/build-vsix/action.yml b/.github/actions/build-vsix/action.yml
index 0f1fc533f4..6bf7e91811 100644
--- a/.github/actions/build-vsix/action.yml
+++ b/.github/actions/build-vsix/action.yml
@@ -9,8 +9,8 @@ outputs:
 runs:
   using: 'composite'
   steps:
-    # This is faster than running `npm ci`, we do not want to build zmq, as its already built by us.
-    - run: npm ci --ignore-scripts --prefer-offline --no-audit
+    # This is faster than running `npm install`, we do not want to build zmq, as its already built by us.
+    - run: npm install --ignore-scripts --prefer-offline --no-audit
       shell: bash
 
     # Run again, as the download of zmq binaries could have failed with 403 errors
diff --git a/.github/actions/npm-ci/action.yml b/.github/actions/npm-ci/action.yml
index e8debcba61..451dc73591 100644
--- a/.github/actions/npm-ci/action.yml
+++ b/.github/actions/npm-ci/action.yml
@@ -1,10 +1,10 @@
-name: 'Install dependencies (npm ci)'
+name: 'Install dependencies (npm install)'
 description: 'npm install (with GITHUB_TOKEN to run postinstall step)'
 
 runs:
   using: 'composite'
   steps:
-    - run: npm ci --foreground-scripts --prefer-offline
+    - run: npm install --foreground-scripts --prefer-offline
       env:
         npm_config_build_from_source: true
       shell: bash
diff --git a/.github/workflows/copilot-setup-steps.yml b/.github/workflows/copilot-setup-steps.yml
index 88ef3d80d0..f35d73dd73 100644
--- a/.github/workflows/copilot-setup-steps.yml
+++ b/.github/workflows/copilot-setup-steps.yml
@@ -57,10 +57,10 @@ jobs:
           path: ./out
           key: ${{runner.os}}-${{env.CACHE_OUT_DIRECTORY}}-${{hashFiles('src/**')}}
 
-      # This is faster than running `npm ci`, we do not want to build zmq, etc.
+      # This is faster than running `npm install`, we do not want to build zmq, etc.
       # Let that happen in other jobs, this job needs to be fast
-      - name: npm ci
-        run: npm ci --ignore-scripts --prefer-offline --no-audit
+      - name: npm install
+        run: npm install --ignore-scripts --prefer-offline --no-audit
         env:
           NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
diff --git a/.github/workflows/deps.yml b/.github/workflows/deps.yml
index d3f441cdca..44a1451f9d 100644
--- a/.github/workflows/deps.yml
+++ b/.github/workflows/deps.yml
@@ -32,7 +32,7 @@ jobs:
           scope: '@deepnote'
 
       - name: Install dependencies
-        run: npm ci --prefer-offline --no-audit
+        run: npm install --prefer-offline --no-audit
         env:
           NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
@@ -63,7 +63,7 @@ jobs:
           cache: 'npm'
 
       - name: Install dependencies
-        run: npm ci --prefer-offline --no-audit
+        run: npm install --prefer-offline --no-audit
 
       - name: Run postinstall
         run: npm run postinstall
diff --git a/.github/workflows/package.yml b/.github/workflows/package.yml
index d6fabe5f1a..c9aff18849 100644
--- a/.github/workflows/package.yml
+++ b/.github/workflows/package.yml
@@ -33,7 +33,7 @@ jobs:
           scope: '@deepnote'
 
       - name: Install dependencies
-        run: npm ci --prefer-offline --no-audit
+        run: npm install --prefer-offline --no-audit
         env:
           NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
diff --git a/build/azure-pipeline.pre-release.yml b/build/azure-pipeline.pre-release.yml
index 485d8eb911..ea603a5264 100644
--- a/build/azure-pipeline.pre-release.yml
+++ b/build/azure-pipeline.pre-release.yml
@@ -73,8 +73,8 @@ extends:
           addToPath: true
           architecture: 'x64'
 
-      - script: npm ci --foreground-scripts
-        displayName: npm ci
+      - script: npm install --foreground-scripts
+        displayName: npm install
         env:
           npm_config_build_from_source: true
           VSC_VSCE_TARGET: $(vsceTarget)
diff --git a/build/azure-pipeline.stable.yml b/build/azure-pipeline.stable.yml
index f0c1659384..0ff3dd7b01 100644
--- a/build/azure-pipeline.stable.yml
+++ b/build/azure-pipeline.stable.yml
@@ -67,8 +67,8 @@ extends:
           addToPath: true
           architecture: 'x64'
 
-      - script: npm ci --foreground-scripts
-        displayName: npm ci
+      - script: npm install --foreground-scripts
+        displayName: npm install
         env:
           npm_config_build_from_source: true
           VSC_VSCE_TARGET: $(vsceTarget)

From 9537ee10362d78699aa5ea7f4dff00f2bde1ed6e Mon Sep 17 00:00:00 2001
From: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Date: Mon, 20 Oct 2025 19:12:21 +0000
Subject: [PATCH 3/5] Revert workflow files back to npm ci

CI workflow files should use npm ci for reproducible builds:
- package.yml (CD workflow)
- deps.yml (dependency checking)
- copilot-setup-steps.yml

Non-workflow files continue to use npm install:
- GitHub actions (npm-ci, build-vsix)
- Azure pipelines (stable, pre-release)
- Post-checkout git hook
- Devcontainer files
---
 .github/workflows/copilot-setup-steps.yml | 6 +++---
 .github/workflows/deps.yml                | 4 ++--
 .github/workflows/package.yml             | 2 +-
 3 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/copilot-setup-steps.yml b/.github/workflows/copilot-setup-steps.yml
index f35d73dd73..88ef3d80d0 100644
--- a/.github/workflows/copilot-setup-steps.yml
+++ b/.github/workflows/copilot-setup-steps.yml
@@ -57,10 +57,10 @@ jobs:
           path: ./out
           key: ${{runner.os}}-${{env.CACHE_OUT_DIRECTORY}}-${{hashFiles('src/**')}}
 
-      # This is faster than running `npm install`, we do not want to build zmq, etc.
+      # This is faster than running `npm ci`, we do not want to build zmq, etc.
       # Let that happen in other jobs, this job needs to be fast
-      - name: npm install
-        run: npm install --ignore-scripts --prefer-offline --no-audit
+      - name: npm ci
+        run: npm ci --ignore-scripts --prefer-offline --no-audit
         env:
           NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
diff --git a/.github/workflows/deps.yml b/.github/workflows/deps.yml
index 44a1451f9d..d3f441cdca 100644
--- a/.github/workflows/deps.yml
+++ b/.github/workflows/deps.yml
@@ -32,7 +32,7 @@ jobs:
           scope: '@deepnote'
 
       - name: Install dependencies
-        run: npm install --prefer-offline --no-audit
+        run: npm ci --prefer-offline --no-audit
         env:
           NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
@@ -63,7 +63,7 @@ jobs:
           cache: 'npm'
 
       - name: Install dependencies
-        run: npm install --prefer-offline --no-audit
+        run: npm ci --prefer-offline --no-audit
 
       - name: Run postinstall
         run: npm run postinstall
diff --git a/.github/workflows/package.yml b/.github/workflows/package.yml
index c9aff18849..d6fabe5f1a 100644
--- a/.github/workflows/package.yml
+++ b/.github/workflows/package.yml
@@ -33,7 +33,7 @@ jobs:
           scope: '@deepnote'
 
       - name: Install dependencies
-        run: npm install --prefer-offline --no-audit
+        run: npm ci --prefer-offline --no-audit
         env:
           NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 

From c7f7cbb3fde756e79496828e459381d4382d4e16 Mon Sep 17 00:00:00 2001
From: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Date: Tue, 21 Oct 2025 10:42:04 +0000
Subject: [PATCH 4/5] Revert GitHub actions and Azure pipelines back to npm ci

All build and deployment pipelines should use npm ci for reproducible builds:
- .github/actions/npm-ci/action.yml
- .github/actions/build-vsix/action.yml
- build/azure-pipeline.stable.yml
- build/azure-pipeline.pre-release.yml

Only the post-checkout git hook and devcontainer files now use npm install.
---
 .github/actions/build-vsix/action.yml | 4 ++--
 .github/actions/npm-ci/action.yml     | 4 ++--
 build/azure-pipeline.pre-release.yml  | 4 ++--
 build/azure-pipeline.stable.yml       | 4 ++--
 4 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/.github/actions/build-vsix/action.yml b/.github/actions/build-vsix/action.yml
index 6bf7e91811..0f1fc533f4 100644
--- a/.github/actions/build-vsix/action.yml
+++ b/.github/actions/build-vsix/action.yml
@@ -9,8 +9,8 @@ outputs:
 runs:
   using: 'composite'
   steps:
-    # This is faster than running `npm install`, we do not want to build zmq, as its already built by us.
-    - run: npm install --ignore-scripts --prefer-offline --no-audit
+    # This is faster than running `npm ci`, we do not want to build zmq, as its already built by us.
+    - run: npm ci --ignore-scripts --prefer-offline --no-audit
       shell: bash
 
     # Run again, as the download of zmq binaries could have failed with 403 errors
diff --git a/.github/actions/npm-ci/action.yml b/.github/actions/npm-ci/action.yml
index 451dc73591..e8debcba61 100644
--- a/.github/actions/npm-ci/action.yml
+++ b/.github/actions/npm-ci/action.yml
@@ -1,10 +1,10 @@
-name: 'Install dependencies (npm install)'
+name: 'Install dependencies (npm ci)'
 description: 'npm install (with GITHUB_TOKEN to run postinstall step)'
 
 runs:
   using: 'composite'
   steps:
-    - run: npm install --foreground-scripts --prefer-offline
+    - run: npm ci --foreground-scripts --prefer-offline
       env:
         npm_config_build_from_source: true
       shell: bash
diff --git a/build/azure-pipeline.pre-release.yml b/build/azure-pipeline.pre-release.yml
index ea603a5264..485d8eb911 100644
--- a/build/azure-pipeline.pre-release.yml
+++ b/build/azure-pipeline.pre-release.yml
@@ -73,8 +73,8 @@ extends:
           addToPath: true
           architecture: 'x64'
 
-      - script: npm install --foreground-scripts
-        displayName: npm install
+      - script: npm ci --foreground-scripts
+        displayName: npm ci
         env:
           npm_config_build_from_source: true
           VSC_VSCE_TARGET: $(vsceTarget)
diff --git a/build/azure-pipeline.stable.yml b/build/azure-pipeline.stable.yml
index 0ff3dd7b01..f0c1659384 100644
--- a/build/azure-pipeline.stable.yml
+++ b/build/azure-pipeline.stable.yml
@@ -67,8 +67,8 @@ extends:
           addToPath: true
           architecture: 'x64'
 
-      - script: npm install --foreground-scripts
-        displayName: npm install
+      - script: npm ci --foreground-scripts
+        displayName: npm ci
         env:
           npm_config_build_from_source: true
           VSC_VSCE_TARGET: $(vsceTarget)

From 2419d9f4f3e320352e8ba3958b306beef77de768 Mon Sep 17 00:00:00 2001
From: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Date: Tue, 21 Oct 2025 10:55:03 +0000
Subject: [PATCH 5/5] Update CONTRIBUTING.md to use npm install for local
 development

Changed all references from npm ci to npm install in documentation:
- Setup instructions
- Typical workflow example
- Local build instructions

This aligns with the change to use npm install for local development
while CI workflows continue to use npm ci for reproducible builds.
---
 CONTRIBUTING.md | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index fca3298da1..7804b104c3 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -58,7 +58,7 @@ The `@deepnote/blocks` package is published on GitHub Packages. To install it, y
    ```
    Replace `YOUR_TOKEN_HERE` with your actual token.
 
-After completing these steps, you can install dependencies normally with `npm ci`. The project's `.npmrc` file is already configured to use GitHub Packages for the `@deepnote` scope.
+After completing these steps, you can install dependencies normally with `npm install`. The project's `.npmrc` file is already configured to use GitHub Packages for the `@deepnote` scope.
 
 On Apple Silicon, you will have to use system versions of `libsodium` and `libzmq` instead of the bundled ones:
 
@@ -78,7 +78,7 @@ npm_config_build_from_source=true npm install zeromq@
 Install the dependecies:
 
 ```shell
-npm ci
+npm install
 # Run this to setup the necessary pre-commit hooks.
 npm run setup-precommit-hook
 python3 -m venv .venv
@@ -277,7 +277,7 @@ Here's an example of a typical workflow:
 
 1. Sync to main (get your fork's main to match vscode-jupyter's main)
 1. Create branch
-1. `npm ci`
+1. `npm install`
 1. `npm run clean`
 1. Start VS code Insiders root
 1. CTRL+SHIFT+B (run the task `compile`)
@@ -354,7 +354,7 @@ Steps to build the extension on your machine once you've cloned the repo:
 ```bash
 > npm install -g @vscode/vsce
 # Perform the next steps in the vscode-jupyter folder.
-> npm ci
+> npm install
 > npm run clean
 > npm run package # This step takes around 10 minutes.
 ```