Repository navigation
Disable unnecessary npm lifecycle scripts in protocol CI #485
Description
The Protocol Specs job installs the locked npm graph with npm ci, allowing dependency install hooks and the repository's postinstall to execute even though its four checks only consume JavaScript, JSON and YAML. The job does not build Docusaurus and does not need the reviewed renderer/search/browser patches applied by postinstall.
This is the confirmed actionable report AaFA6dpNf2KKc_2IRfId (githubactions:S6505, .github/workflows/protocol-specs.yml:27) from the existing central Sonar review. Current main and latest analyzed revision both equal acaca37ab5aabaa2c4c9a565accac464d10f9f3a; the report is not stale.
Change this job to npm ci --ignore-scripts and verify that all four existing protocol checks pass after that fresh installation. Keep the locked graph, actual checks and ordinary CI gates. Do not mutate scanner findings, rules or exclusions.
Owner: durable-workflow-github-io. Implementation and current-head qualification follow in a normal draft PR. A main merge triggers the existing automatic Pages follower even for this workflow-only change; report that input/effect graph before integration. No manual dispatch, installer, browser or new publication operation is selected by this issue.
Activity
rmcdaniel commentedon Nov 6, 2026
Completed in normal merged #486 at
add401ee966c8359773066f410321914779190fd. The actual main scripts-disabled install and all four protocol commands passed, all12 main check runs passed, and the original protected Pages deployment/artifact/live follow-through is verified. All10,087 generated files match the prior accepted site;15 representative HTTPS reads match the new artifact. Exact merged-branch cleanup is verified.Full immutable source/check/deployment/artifact/live receipt. Sonar automatically marks the original lifecycle key
AaFA6dpNf2KKc_2IRfIdCLOSED/FIXED at the new main analysis. The separate PATH key remains OPEN with its bounded caller disposition, so no zero-security-report claim is made. No manual scanner-state/config mutation occurred.