Repository navigation
deps: installs run no package scripts, lockfiles carry integrity, cargo builds are locked - #3317
Merged
Merged
Conversation
…go builds are locked Use frozen npm installs with lifecycle scripts disabled at local lockfile-backed build and test entry points. Install the pinned Cypress browser explicitly where end-to-end tests need it. Add registry URLs and integrity to the legacy participation lock without changing package versions. Refuse missing Anthropic SDK at runtime and direct environment builders to the existing pinned requirements. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Ss9NfEMZS9Qm4FZ2npXDrx
… the flag, as its campaign test asserts Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Ss9NfEMZS9Qm4FZ2npXDrx
…ange moves to its own pull request The recording rules and product code may not change in one pull request (the routing guard enforces it). Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Ss9NfEMZS9Qm4FZ2npXDrx
Contributor
Delphi Coverage Report
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Supply-chain hygiene for every dependency install in the repository. No dependency is removed and no resolved version changes.
Observable changes: none in served behaviour. The built server, client-admin and client-report outputs are byte-identical with and without this change; client-participation-alpha differs only in its generated manifest key and a timestamp-salted asset name (verified on 260, 90, 21 and 68 output files respectively).
What changes.
npm ci --ignore-scripts: a frozen install that executes no package lifecycle script. Each of the twelve lifecycle hooks in the locked trees was read; none is needed for the repository's default builds (the native bindings for esbuild, sharp, unrs-resolver and @parcel/watcher load from their locked prebuilt optional packages on Darwin and Linux). The one real exception, Cypress's browser download, now runs explicitly after the e2e install from the locked package.cargo build,cargo test,cargo clippyandcargo installin workflows, Dockerfiles, the Makefile and scripts runs--locked.Left unchanged, on purpose: the Playwright proof scratch install (no manifest or lock exists for its generated directory) and the Sensemaker workflow, which installs from an external checkout whose lock is not in this repository. Both are named in the change for a later decision.
Verification: eight native builds and eight Docker image builds (before and after) pass; server unit tests 1,276 pass before and after; client-admin, client-participation-alpha and client-report lints pass before and after; the Cypress install was exercised into an empty cache from the lock.
🤖 Generated with Claude Code
https://claude.ai/code/session_01Ss9NfEMZS9Qm4FZ2npXDrx