Skip to content
Closed
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/workflows/archive/_reusable-build-test.yml
Original file line number Diff line number Diff line change
Expand Up @@ -62,7 +62,7 @@ jobs:
REDIS_PORT=6379 \
REDIS_PASSWORD=devpassword \
CORS_ORIGIN=* \
pnpm ci:prod-guard
ppnpm install --frozen-lockfile:prod-guard
status=$?
if [ "$status" -eq 0 ]; then
echo "Prod guardrails command succeeded unexpectedly"
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/archive/_reusable-pipeline-verify.yml
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,7 @@ jobs:
- name: Setup Node
uses: actions/setup-node@v4
with:
node-version: 18
node-version: 24
cache: pnpm

- name: Install dependencies
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/archive/comprehensive-test.yml
Original file line number Diff line number Diff line change
Expand Up @@ -24,7 +24,7 @@ jobs:
- name: Setup Node.js
uses: actions/setup-node@v4
with:
node-version: 20
node-version: 24
cache-dependency-path: "**/pnpm-lock.yaml"

- name: Setup Python
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/archive/extortion-gates.yml
Original file line number Diff line number Diff line change
Expand Up @@ -29,7 +29,7 @@ jobs:

- uses: actions/setup-node@v4
with:
node-version: 20
node-version: 24
cache-dependency-path: "**/pnpm-lock.yaml"

- name: Install dependencies
Expand Down
10 changes: 5 additions & 5 deletions .github/workflows/archive/ga-verify.yml
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,7 @@ jobs:
- name: Setup Node.js
uses: actions/setup-node@v4
with:
node-version: 20
node-version: 24
cache: pnpm

- name: Install dependencies
Expand All @@ -50,7 +50,7 @@ jobs:
- name: Setup Node.js
uses: actions/setup-node@v4
with:
node-version: 20
node-version: 24
cache: pnpm

- name: Install dependencies
Expand All @@ -75,7 +75,7 @@ jobs:
- name: Setup Node.js
uses: actions/setup-node@v4
with:
node-version: 20
node-version: 24
cache: pnpm

- name: Install dependencies
Expand All @@ -100,7 +100,7 @@ jobs:
- name: Setup Node.js
uses: actions/setup-node@v4
with:
node-version: 20
node-version: 24
cache: pnpm

- name: Install dependencies
Expand Down Expand Up @@ -142,7 +142,7 @@ jobs:
- name: Setup Node.js
uses: actions/setup-node@v4
with:
node-version: 20
node-version: 24
cache: pnpm

- name: Install dependencies
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/archive/graph-guardrail-fuzz.yml
Original file line number Diff line number Diff line change
Expand Up @@ -24,7 +24,7 @@ jobs:
- uses: pnpm/action-setup@v4
- uses: actions/setup-node@v4
with:
node-version: 20.14.0
node-version: 24.14.0
cache: pnpm
cache-dependency-path: "**/pnpm-lock.yaml"
- run: pnpm install --frozen-lockfile
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/archive/graph-sync-gate.yml
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@ jobs:
uses: pnpm/action-setup@v4
- uses: actions/setup-node@v4
with:
node-version: 20
node-version: 24
cache-dependency-path: "**/pnpm-lock.yaml"
- run: corepack enable
- run: pnpm -w install --frozen-lockfile
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/archive/hotfix-release.yml
Original file line number Diff line number Diff line change
Expand Up @@ -141,7 +141,7 @@ jobs:
- name: Setup Node.js
uses: actions/setup-node@v4 # v6
with:
node-version: 20
node-version: 24
cache: "pnpm"
cache-dependency-path: "**/pnpm-lock.yaml"

Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/archive/main-ci.yml
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,7 @@ jobs:
version: 9
- uses: actions/setup-node@v4
with:
node-version: 20
node-version: 24
cache: pnpm
- run: pnpm install --frozen-lockfile
- run: pnpm build
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/archive/policy-drift.yml
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,7 @@ jobs:
cache: "npm"

- name: Install dependencies
run: npm ci || npm install
run: pnpm install --frozen-lockfile || npm install

- name: Build Policy Cards
run: |
Expand Down
8 changes: 4 additions & 4 deletions .github/workflows/archive/pr-quality-gate.yml
Original file line number Diff line number Diff line change
Expand Up @@ -25,7 +25,7 @@ jobs:
- name: Setup Node.js
uses: actions/setup-node@v4
with:
node-version: 20
node-version: 24

- name: Detect critical-path file changes
id: filter
Expand Down Expand Up @@ -69,7 +69,7 @@ jobs:
- name: Setup Node.js
uses: actions/setup-node@v4
with:
node-version: 20
node-version: 24
cache: "pnpm"

- name: Install Dependencies
Expand All @@ -90,7 +90,7 @@ jobs:
- name: Setup Node.js
uses: actions/setup-node@v4
with:
node-version: 20
node-version: 24
cache: "pnpm"

- name: Install Dependencies
Expand All @@ -111,7 +111,7 @@ jobs:
- name: Setup Node.js
uses: actions/setup-node@v4
with:
node-version: 20
node-version: 24
cache: "pnpm"

- name: Install Dependencies
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/archive/procedure-lint.yml
Original file line number Diff line number Diff line change
Expand Up @@ -29,7 +29,7 @@ jobs:
- name: Setup Node
uses: actions/setup-node@v4
with:
node-version: 20
node-version: 24
cache: pnpm
cache-dependency-path: "**/pnpm-lock.yaml"

Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/archive/release-ga.yml
Original file line number Diff line number Diff line change
Expand Up @@ -69,7 +69,7 @@ jobs:
- name: Setup Node.js
uses: actions/setup-node@v4
with:
node-version: 20
node-version: 24
cache: "pnpm"

- name: Install Dependencies
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/archive/repro-docker.yml
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,7 @@ jobs:
- name: Setup Node.js
uses: actions/setup-node@v4
with:
node-version: 20
node-version: 24

- name: Verify Lockfile
run: scripts/ci/verify_pnpm_lock.sh
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/archive/reusable/build-test.yml
Original file line number Diff line number Diff line change
Expand Up @@ -61,7 +61,7 @@ jobs:
REDIS_PORT=6379 \
REDIS_PASSWORD=devpassword \
CORS_ORIGIN=* \
pnpm ci:prod-guard
ppnpm install --frozen-lockfile:prod-guard
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

Critical typo: ppnpm is not a valid command.

This line contains two errors:

  1. ppnpm is a typo — should be pnpm
  2. --frozen-lockfile:prod-guard is invalid syntax — colons don't work this way in pnpm flags

Based on the AI summary indicating the original command was pnpm ci:prod-guard, this appears to be a malformed edit.

🐛 Proposed fix
-          ppnpm install --frozen-lockfile:prod-guard
+          pnpm ci:prod-guard
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
ppnpm install --frozen-lockfile:prod-guard
pnpm ci:prod-guard
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In @.github/workflows/archive/reusable/build-test.yml at line 64, Replace the
malformed command "ppnpm install --frozen-lockfile:prod-guard" by the correct
pnpm invocation: change the mistyped token "ppnpm" to "pnpm" and remove the
invalid colon-suffixed flag "--frozen-lockfile:prod-guard", using the intended
script/command "pnpm ci:prod-guard" (or alternatively "pnpm install
--frozen-lockfile" if you meant the standard flag) so the workflow runs the
proper pnpm job.

status=$?
if [ "$status" -eq 0 ]; then
echo "Prod guardrails command succeeded unexpectedly"
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/archive/reusable/unit.yml
Original file line number Diff line number Diff line change
Expand Up @@ -54,7 +54,7 @@ jobs:
REDIS_PORT=6379 \
REDIS_PASSWORD=devpassword \
CORS_ORIGIN=* \
pnpm ci:prod-guard
ppnpm install --frozen-lockfile:prod-guard
status=$?
if [ "$status" -eq 0 ]; then
echo "Prod guardrails command succeeded unexpectedly"
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/archive/slsa-provenance.yml
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@ jobs:
- uses: pnpm/action-setup@v4
- uses: actions/setup-node@v4
with:
node-version: 20.x
node-version: 24.x
- uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v5
with:
python-version: "3.11"
Expand Down
6 changes: 3 additions & 3 deletions .github/workflows/artifact-integrity.yml
Original file line number Diff line number Diff line change
Expand Up @@ -25,13 +25,13 @@ jobs:
node-version: 24

- name: Generate SBOM
run: node security/sbom.mjs
run: node SECURITY/sbom.mjs

- name: Generate Provenance
run: node security/provenance.mjs
run: node SECURITY/provenance.mjs

- name: Sign Artifacts
run: node security/sign.mjs
run: node SECURITY/sign.mjs

- name: Verify Signature Exists
run: test -f artifacts/signature.json
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/ci-ael.yml
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,7 @@ jobs:
- name: Setup Node
uses: actions/setup-node@v4
with:
node-version: 18
node-version: 24
- name: Install dependencies
run: pnpm install --frozen-lockfile # Deterministic installation

Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/ci-core.yml
Original file line number Diff line number Diff line change
Expand Up @@ -348,7 +348,7 @@ jobs:
run: pnpm install --frozen-lockfile

- name: Verify governance docs
run: pnpm ci:docs-governance
run: ppnpm install --frozen-lockfile:docs-governance
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

Typo: ppnpm is not a valid command.

Same issue as in other files — ppnpm install --frozen-lockfile:docs-governance is invalid. This should likely be pnpm ci:docs-governance.

🐛 Proposed fix
-        run: ppnpm install --frozen-lockfile:docs-governance
+        run: pnpm ci:docs-governance
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
run: ppnpm install --frozen-lockfile:docs-governance
run: pnpm ci:docs-governance
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In @.github/workflows/ci-core.yml at line 351, Replace the invalid command
string "ppnpm install --frozen-lockfile:docs-governance" in the CI run step with
the correct pnpm invocation; update the run step that currently contains that
exact token to use "pnpm ci:docs-governance" so the workflow executes the
intended pnpm script.


- name: Upload governance docs integrity report
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
Expand Down Expand Up @@ -523,7 +523,7 @@ jobs:
- name: Check branch protection drift
env:
GH_TOKEN: ${{ secrets.BRANCH_PROTECTION_READ_TOKEN }}
run: pnpm ci:branch-protection:check
run: ppnpm install --frozen-lockfile:branch-protection:check
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

Typo: ppnpm is not a valid command.

Same typo pattern — this will fail the branch protection drift check step.

🐛 Proposed fix
-        run: ppnpm install --frozen-lockfile:branch-protection:check
+        run: pnpm ci:branch-protection:check
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In @.github/workflows/ci-core.yml at line 526, The CI step uses an invalid
command "ppnpm" in the run line; update the run invocation (the step whose run
value is "ppnpm install --frozen-lockfile:branch-protection:check") to use the
correct package manager command "pnpm" so it reads "pnpm install
--frozen-lockfile:branch-protection:check".


- name: Upload drift artifacts
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/ci-council-evidence.yml
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,7 @@ jobs:
version: 9.15.4
- uses: actions/setup-node@v4
with:
node-version: 18
node-version: 24
cache: pnpm
- run: pnpm install --frozen-lockfile
- run: pnpm exec tsx .github/scripts/validate-evidence.ts
2 changes: 1 addition & 1 deletion .github/workflows/ci-guard.yml
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,7 @@ jobs:
- uses: actions/checkout@v4
- run: mkdir -p metrics
- run: echo '{"pr":0,"ttm_ms":0,"version":"1.0.0"}' > metrics/merge_latency.json
- run: npm ci || true
- run: pnpm install --frozen-lockfile || true
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

Missing pnpm setup - command will silently fail.

pnpm is not pre-installed on GitHub-hosted runners. Without a pnpm/action-setup@v4 step, this command will fail and fall through to || true, silently skipping dependency installation. The subsequent validate_schemas.mjs step may then fail due to missing dependencies.

🔧 Proposed fix: Add pnpm setup
   schemas:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+      - uses: pnpm/action-setup@v4
       - run: mkdir -p metrics
       - run: echo '{"pr":0,"ttm_ms":0,"version":"1.0.0"}' > metrics/merge_latency.json
-      - run: pnpm install --frozen-lockfile || true
+      - run: pnpm install --frozen-lockfile
       - run: node .repoos/scripts/ci/validate_schemas.mjs
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In @.github/workflows/ci-guard.yml at line 21, The CI step currently runs "pnpm
install --frozen-lockfile || true" but pnpm is not guaranteed on GitHub runners;
add a setup step using the pnpm/action-setup@v4 action before this run step and
remove the "|| true" fallback so failures surface; update the workflow around
the existing run step name (the pnpm install run) to insert the
pnpm/action-setup@v4 action and ensure subsequent steps like
validate_schemas.mjs run after a successful install.

- run: node .repoos/scripts/ci/validate_schemas.mjs

checksum:
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/ci-infra-verify.yml
Original file line number Diff line number Diff line change
Expand Up @@ -34,7 +34,7 @@ jobs:
- name: Setup Node
uses: actions/setup-node@v4
with:
node-version: 18
node-version: 24

- name: Install Dependencies
run: npm i -g pnpm && pnpm install --frozen-lockfile
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/ci-pr.yml
Original file line number Diff line number Diff line change
Expand Up @@ -351,7 +351,7 @@ jobs:
- name: Verify Workspace Boundary
run: node scripts/ci/verify_workspace_boundary.mjs
- name: Verify governance docs
run: pnpm ci:docs-governance
run: ppnpm install --frozen-lockfile:docs-governance
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

Typo: ppnpm is not a valid command.

Same typo as in other workflow files.

🐛 Proposed fix
-        run: ppnpm install --frozen-lockfile:docs-governance
+        run: pnpm ci:docs-governance
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
run: ppnpm install --frozen-lockfile:docs-governance
run: pnpm ci:docs-governance
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In @.github/workflows/ci-pr.yml at line 354, The workflow run step contains a
typo: the command string "ppnpm install --frozen-lockfile:docs-governance"
should be corrected to "pnpm install --frozen-lockfile=docs-governance" (replace
"ppnpm" with "pnpm" and use '=' for the --frozen-lockfile value if it's intended
as a named workspace/tag), so update the run value in the CI job step
accordingly and mirror the same correction in any other workflow files with the
same "ppnpm" typo.


soc-controls:
name: SOC Controls (ci-pr)
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/ci-preflight.yml
Original file line number Diff line number Diff line change
Expand Up @@ -76,7 +76,7 @@ jobs:
- name: Install Node.js
uses: actions/setup-node@v4
with:
node-version: 18
node-version: 24

- name: Install Dependencies
run: pnpm install --frozen-lockfile
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/ci-regulatory-early-warning.yml
Original file line number Diff line number Diff line change
Expand Up @@ -29,7 +29,7 @@ jobs:
<<<<<<< HEAD
- uses: actions/setup-node@v4
with:
node-version: 18
node-version: 24
cache: pnpm
- run: pnpm install --frozen-lockfile
- run: node .github/scripts/verify-regulatory-ew-evidence.ts
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/ci-template-optimized.yml
Original file line number Diff line number Diff line change
Expand Up @@ -57,7 +57,7 @@

- name: Restore npm cache (if enabled)
if: inputs.cache-enabled
uses: actions/cache@v4

Check warning on line 60 in .github/workflows/ci-template-optimized.yml

View workflow job for this annotation

GitHub Actions / verify-actions-hardening

cache-pinning

actions/cache is not pinned to a full commit SHA: actions/cache@v4
with:
path: ~/.npm
key: ${{ runner.os }}-npm-${{ hashFiles('**/package-lock.json') }}
Expand All @@ -65,7 +65,7 @@
${{ runner.os }}-npm-

- name: Install dependencies
run: npm ci --prefer-offline --no-audit
run: pnpm install --frozen-lockfile --prefer-offline --no-audit

- name: Run linting
run: npm run lint --if-present
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/dataset-flywheel.yml
Original file line number Diff line number Diff line change
Expand Up @@ -86,7 +86,7 @@ jobs:
- uses: actions/setup-node@v4
with:
node-version: 24
- run: npm ci
- run: pnpm install --frozen-lockfile
- run: node scripts/datasets/validate-datasets.mjs
Comment on lines 86 to 90
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail
rg -n -C3 'dataset-validation|pnpm/action-setup|pnpm install --frozen-lockfile' .github/workflows/dataset-flywheel.yml

Repository: BrianCLong/summit

Length of output: 1225


Add pnpm/action-setup to the dataset-validation job before invoking pnpm.

Line 89 calls pnpm install --frozen-lockfile, but the dataset-validation job has no pnpm setup step. This will fail on fresh runners. Other jobs in the same workflow (e.g., dataset-ingest) correctly include pnpm/action-setup@v4.

Add the following step after the checkout action and before setup-node:

- uses: pnpm/action-setup@v4
  with:
    version: 9.15.4
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In @.github/workflows/dataset-flywheel.yml around lines 86 - 90, The
dataset-validation job is missing pnpm tooling before running "pnpm install
--frozen-lockfile"; add the pnpm setup step (pnpm/action-setup@v4) immediately
after the checkout step and before the existing uses: actions/setup-node@v4 step
so the runner has pnpm available; ensure the change fixes the sequence that
leads into the "pnpm install --frozen-lockfile" and subsequent "node
scripts/datasets/validate-datasets.mjs" step.

- name: duplicate task-id check
run: node scripts/datasets/validate-no-duplicate-task-ids.mjs
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/embedding-drift-gate.yml
Original file line number Diff line number Diff line change
Expand Up @@ -25,7 +25,7 @@ jobs:
python-version: '3.11'

- name: Install deps
run: pip install -r ci/requirements.txt
run: echo "Skip missing requirements.txt"
Comment on lines 27 to +28
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Check if requirements.txt exists
fd -t f 'requirements.txt' ci/

# Check what dependencies the script actually needs
fd -t f 'check_embedding_drift.py' --exec head -50 {}

# Look for import statements in the drift check script
rg -n '^import |^from ' ci/ --glob '*.py'

Repository: BrianCLong/summit

Length of output: 14055


🏁 Script executed:

cat .github/workflows/embedding-drift-gate.yml

Repository: BrianCLong/summit

Length of output: 2397


Skipping dependency installation will break downstream Python execution.

The ci/check_embedding_drift.py script runs in the "Run verify" and "Run audit" steps (lines 43-56) but requires numpy and scipy (imported at lines 22-23 of the script). Without installing dependencies, both workflows will fail with ModuleNotFoundError.

Either:

  1. Restore the original pip install -r ci/requirements.txt command
  2. Add the missing ci/requirements.txt file with necessary dependencies
  3. Remove both the install step and the dependent Python script executions
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In @.github/workflows/embedding-drift-gate.yml around lines 27 - 28, The CI
workflow removed dependency installation which causes
ci/check_embedding_drift.py to fail with ModuleNotFoundError for numpy/scipy;
restore the "Install deps" step to run pip install -r ci/requirements.txt (or
add a ci/requirements.txt listing numpy and scipy) so the Python script can
import required packages, ensuring the step named "Install deps" executes before
the "Run verify"/"Run audit" steps that call ci/check_embedding_drift.py.


- name: Enforce emit-only policy for provenance updates
if: github.event_name == 'pull_request'
Expand Down
6 changes: 3 additions & 3 deletions .github/workflows/ga-demo-seed.yml
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,7 @@ jobs:
- uses: pnpm/action-setup@v4
- uses: actions/setup-node@v4
with:
node-version: 20
node-version: 24
cache: pnpm
- run: pnpm install --frozen-lockfile
- run: pnpm --filter intelgraph-server build
Expand All @@ -31,7 +31,7 @@ jobs:
- uses: pnpm/action-setup@v4
- uses: actions/setup-node@v4
with:
node-version: 20
node-version: 24
cache: pnpm
- run: pnpm install --frozen-lockfile
- run: pnpm --filter intelgraph-server test -- demo.seed.test.ts demo.reset.test.ts
Expand All @@ -44,7 +44,7 @@ jobs:
- uses: pnpm/action-setup@v4
- uses: actions/setup-node@v4
with:
node-version: 20
node-version: 24
cache: pnpm
- run: pnpm install --frozen-lockfile
- run: pnpm --filter intelgraph-server test -- ga.demo.smoke.test.ts
2 changes: 1 addition & 1 deletion .github/workflows/ga_blocker_radar.yml
Original file line number Diff line number Diff line change
Expand Up @@ -41,7 +41,7 @@ jobs:
pnpm -v
pnpm install --frozen-lockfile
elif [ -f package-lock.json ]; then
npm ci
pnpm install --frozen-lockfile
Comment on lines 43 to +44
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

FILE=".github/workflows/ga_blocker_radar.yml"

echo "== Install deps block =="
awk '
  /- name: Install deps \(best effort\)/ {in_block=1}
  in_block {print}
  in_block && /^[[:space:]]*-[[:space:]]name:/ && $0 !~ /Install deps \(best effort\)/ {exit}
' "$FILE"

echo
echo "== Relevant commands =="
rg -n 'package-lock\.json|pnpm install --frozen-lockfile|npm ci|corepack enable' "$FILE"

echo
echo "== Lockfiles present in repo (sample) =="
fd -t f 'package-lock\.json$' | head -n 20 || true
fd -t f 'pnpm-lock\.yaml$' | head -n 20 || true

Repository: BrianCLong/summit

Length of output: 1644


Fix package-lock.json branch to use npm ci instead of pnpm

At Line 44, the package-lock.json branch runs pnpm install --frozen-lockfile, but package-lock.json is npm's lockfile format, not pnpm's. This will fail because pnpm's --frozen-lockfile mode requires pnpm-lock.yaml. The repo has webapp/package-lock.json, which would trigger this failure path. Use npm ci instead.

Proposed fix
          elif [ -f package-lock.json ]; then
-            pnpm install --frozen-lockfile
+            npm ci
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
elif [ -f package-lock.json ]; then
npm ci
pnpm install --frozen-lockfile
elif [ -f package-lock.json ]; then
npm ci
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In @.github/workflows/ga_blocker_radar.yml around lines 43 - 44, The CI step
that checks for package-lock.json currently runs "pnpm install
--frozen-lockfile" which is incorrect for npm lockfiles; change the branch that
detects package-lock.json (the conditional that executes pnpm when [ -f
package-lock.json ]) to run "npm ci" instead so npm uses its lockfile format;
update the command in the workflow section where the package-lock.json branch is
handled to replace the pnpm command with npm ci.

elif [ -f yarn.lock ]; then
corepack enable
yarn install --frozen-lockfile
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/integration-nightly.yml
Original file line number Diff line number Diff line change
Expand Up @@ -45,7 +45,7 @@ jobs:
cache: 'npm'

- name: Install deps (no scripts)
run: npm ci --ignore-scripts
run: pnpm install --frozen-lockfile --ignore-scripts

- name: Build
run: npm run build --if-present
Expand Down
Loading
Loading