From fa59968afe8fe91e1871ec8ada1abd03b7654139 Mon Sep 17 00:00:00 2001 From: kkdev92 <112151103+kkdev92@users.noreply.github.com> Date: Thu, 13 Aug 2026 21:29:42 +0900 Subject: [PATCH] ci: do not run install hooks in the TypeScript 7 canary MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The lane resolves `typescript@latest` on purpose — it is a canary against a moving target, and pinning it would remove the only thing it measures. So the unpinned install stays, and Scorecard's Pinned-Dependencies finding is accepted rather than satisfied. Checked against Scorecard's source: version pinning does not clear that check either, only a lockfile install does, and there is no way to mark a step intentionally unpinned. What can be improved without touching the purpose is the install itself. `--ignore-scripts` removes lifecycle-hook execution from the one unpinned install in this repository. The job's exposure was already small — it inherits `contents: read`, references no secrets and uploads no artefacts — and this takes out the remaining code path. Verified locally with the exact command: installs 7.0.2, and `tsc -b tsconfig.build.json --force` still exits 0. The comment now separates the two reasons for staying on 6.0.x. Only typescript-eslint declares a `typescript` range (`>=4.8.4 <6.1.0`), and it is the only dev dependency that declares one at all — vitest, vite and knip declare none — so it is the thing to re-check when it lifts. That the wider toolchain is not ready in practice is the other reason, and not one a peer range will tell you. Co-Authored-By: Claude Opus 5 (1M context) --- .github/workflows/ci.yml | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 5131160..7a5af19 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -154,8 +154,17 @@ jobs: run: npm run verify:package # Non-blocking: TypeScript 7 is already npm's `latest`, so consumers default - # to it, but typescript-eslint supports only `>=4.8.4 <6.1.0`, which pins the - # build to 6.0.x. This lane keeps the gap visible instead of implicit. + # to it, while this repository builds with 6.0.x. Two separate reasons, and + # only the first is machine-enforced: typescript-eslint declares + # `typescript >=4.8.4 <6.1.0`, and it is the only dev dependency that declares + # a range at all — so that is the one to re-check when it lifts. The rest of + # the toolchain declares nothing and is not ready in practice either. + # + # The lane resolves `latest` on purpose: it is a canary against a moving + # target, so pinning it would remove the only thing it measures. Scorecard + # flags the unpinned install (Pinned-Dependencies); that is accepted and + # dismissed rather than satisfied. `--ignore-scripts` is the part worth + # having — an unpinned install has no reason to run lifecycle hooks. typescript7: runs-on: ubuntu-latest continue-on-error: true @@ -174,7 +183,7 @@ jobs: run: npm ci - name: Override TypeScript with the 7.x line - run: npm install --no-save typescript@7 + run: npm install --no-save --ignore-scripts typescript@7 - name: Report compiler version run: npx tsc --version