fix: revert --ignore-scripts for Claude Code (needs postinstall)

[lpcox]

Problem

PR #3363 added --ignore-scripts to Claude Code's npm install in the post-processing script. However, Claude Code's postinstall downloads the platform-specific native binary — without it, claude fails at runtime with:

Error: claude native binary not installed

This was caught by the Smoke Claude workflow failing: https://github.com/github/gh-aw-firewall/actions/runs/26064933319

Fix

• Remove the --ignore-scripts injection for Claude Code from postprocess-smoke-workflows.ts
• Update workflow-engine-install-security.test.ts to only require --ignore-scripts for Codex (which is pure JS and doesn't need postinstall)
• Revert --ignore-scripts in affected lock files (smoke-claude, secret-digger-claude, security-guard)

Context

• Codex (@openai/codex): Pure JS, works fine with --ignore-scripts ✅
• Claude Code (@anthropic-ai/claude-code): Needs postinstall for native binary ❌

Supersedes the --ignore-scripts portion of #3363.

[Copilot]

Pull request overview

This PR reverts the Claude Code --ignore-scripts install behavior because Claude Code requires its postinstall script to download the native binary, while preserving stricter install checks for Codex and updating affected generated workflows.

Changes:

• Excludes Claude Code from the install-security test rule requiring --ignore-scripts.
• Documents in the smoke workflow postprocessor why Claude Code must not use --ignore-scripts.
• Adds the shared gh-aw MCP import and regenerated lock workflow content for two workflows.

Show a summary per file

File	Description
scripts/ci/workflow-engine-install-security.test.ts	Narrows install-security enforcement to Codex only.
scripts/ci/postprocess-smoke-workflows.ts	Adds comments documenting Claude Code postinstall requirements.
.github/workflows/pelis-agent-factory-advisor.md	Imports shared gh-aw MCP setup.
.github/workflows/pelis-agent-factory-advisor.lock.yml	Regenerated lock file with shared gh-aw setup.
.github/workflows/ci-cd-gaps-assessment.md	Imports shared gh-aw MCP setup.
.github/workflows/ci-cd-gaps-assessment.lock.yml	Regenerated lock file with shared gh-aw setup.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 6/6 changed files
• Comments generated: 1

[github-actions]

🔬 Smoke Test Results

Test	Result
GitHub MCP connectivity	✅ PR data fetched successfully
GitHub.com HTTP connectivity	✅ (pre-step data unavailable — template vars unexpanded)
File write/read	✅ (pre-step data unavailable — template vars unexpanded)

Overall: PASS ✅

PR: fix: revert --ignore-scripts for Claude Code (needs postinstall)
Author: @lpcox

📰 BREAKING: Report filed by Smoke Copilot

[github-actions]

🔥 Smoke Test: Copilot BYOK (Offline) Mode

Test	Result
GitHub MCP (list PRs)	✅
GitHub.com connectivity	⚠️ N/A (pre-step template not expanded)
File write/read	⚠️ N/A (pre-step template not expanded)
BYOK inference (agent → api-proxy → api.githubcopilot.com)	✅

Running in BYOK offline mode (COPILOT_OFFLINE=true) via api-proxy → api.githubcopilot.com.

Author: @lpcox | Overall: PASS (core BYOK path verified)

🔑 BYOK report filed by Smoke Copilot BYOK

[github-actions]

Smoke Test Summary

PRs: fix: add resilient gh-aw installer and --ignore-scripts to lock files; Refactor container cleanup to deduplicate log/session preservation paths
GitHub MCP/read: ✅
safeinputs-gh: ❌ unavailable
Playwright title: ✅
Tavily search: ❌ no tools returned
File write + bash read: ✅
Discussion comment: ✅
Build: ✅
Overall status: FAIL

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "registry.npmjs.org"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex

[github-actions]

Gemini Engine Smoke Test Results

• GitHub MCP Testing: ❌ (mcpscripts tool missing, retrieved via API fallback)
• GitHub.com Connectivity: ✅ (200 via proxy)
• File Writing Testing: ✅
• Bash Tool Testing: ✅

Overall status: FAIL (MCP CLI tools missing from environment)

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• localhost

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "localhost"

See Network Configuration for more information.

💎 Faceted by Smoke Gemini

[github-actions]

🏗️ Build Test Suite Results

Ecosystem	Project	Build/Install	Tests	Status
Bun	elysia	✅	1/1 passed	✅ PASS
Bun	hono	✅	1/1 passed	✅ PASS
C++	fmt	✅	N/A	✅ PASS
C++	json	✅	N/A	✅ PASS
Deno	oak	N/A	1/1 passed	✅ PASS
Deno	std	N/A	1/1 passed	✅ PASS
.NET	hello-world	✅	N/A	✅ PASS
.NET	json-parse	✅	N/A	✅ PASS
Go	color	✅	1/1 passed	✅ PASS
Go	env	✅	1/1 passed	✅ PASS
Go	uuid	✅	1/1 passed	✅ PASS
Java	gson	✅	1/1 passed	✅ PASS
Java	caffeine	✅	1/1 passed	✅ PASS
Node.js	clsx	✅	passed	✅ PASS
Node.js	execa	✅	passed	✅ PASS
Node.js	p-limit	✅	passed	✅ PASS
Rust	fd	✅	1/1 passed	✅ PASS
Rust	zoxide	✅	1/1 passed	✅ PASS

Overall: 8/8 ecosystems passed — ✅ PASS

Note (Java): Default Maven local repo path (~/.m2/repository) had a permissions issue (directory owned by root). Tests ran successfully using -Dmaven.repo.local=/tmp/gh-aw/agent/m2repo.

Generated by Build Test Suite for issue #3371 · ● 3.9M · ◷

[github-actions]

Smoke Test Results — FAIL

Check	Result
Redis PING	❌ timeout (no response)
PostgreSQL pg_isready	❌ no response
PostgreSQL SELECT 1	❌ timeout

host.docker.internal is unreachable from this runner. All three connectivity checks failed — FAIL.

🔌 Service connectivity validated by Smoke Services