mirror of
https://github.com/okieselbach/AutopilotMonitor.git
synced 2026-11-08 02:54:21 +00:00
Oliver Kieselbach
96d2e6610a
The deploy job holds the SWA deployment token, and it ran the SWA CLI through `npx --yes --package`: only the top package was pinned, its dependency tree came from the registry at run time, install scripts included. The job now installs the CLI from .github/tools/swa-cli/package-lock.json with `npm ci --ignore-scripts`, right after the checkout and before the build artifact arrives, and runs that binary with the same arguments. keytar, the one package with an install script, only serves the keychain, which --no-use-keychain keeps unloaded. Dependabot proposes bumps with the 7-day cooldown of the other tooling; deploy-web watches the folder, so a merged bump redeploys. action-pins.yml gets a fourth job, packages. It allows npx and npm exec only as `--no -- <tool>` (without --no, CI installs a missing package unasked; without --, npx hands the tool's flags to npm), .NET tools only with an exact --version and PowerShell modules only with an exact version. zizmor's adhoc-packages audit reports `npm install <pkg>` but none of these forms. CI's three npx calls and the Pester install of the bootstrap gates (6.2.0, the version they resolve today) follow the rule. Decision D-415. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>