ceos/unsloth
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

ci: pin install to lockfile in remaining install paths

Browse source 
Followup to 152fe8d. Three more sites still called naked
`bun install` / `npm install`, which honour caret ranges in
package.json and can pull a fresh minor/patch of a transitive
dep from the registry on the next run.

studio/setup.ps1 (4 sites): the Windows end-user installer.
bun install -> bun install --frozen-lockfile (both initial
and the cache-clear retry); the npm fallback and the OXC
validator npm install both -> npm ci. Error messages updated
to reference the new command.

studio/setup.sh: the OXC validator runtime install for the
Unix path was still naked `npm install`. Now `npm ci`.

github/workflows/release-desktop.yml: the desktop release
build's frontend install was still naked `npm install`. Now
`npm ci` so a published .app/.dmg/.AppImage/.msi can never
have shipped with a registry-resolved transitive that drifted
from the committed lockfile.

The pinned Tauri CLI install in the same workflow stays as
`npm install --save-dev @tauri-apps/cli@2.10.1` because that
line is intentionally adding a specific package to package.json,
not syncing from the lockfile.

Verified `npm ci --no-fund --no-audit --dry-run` exits 0 against
both the studio/frontend and studio/backend/core/data_recipe/
oxc-validator lockfiles.
This commit is contained in:
Daniel Han 2026-05-16 06:04:28 +00:00
commit 883f26a2a4
3 changed files with 24 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

6
.github/workflows/release-desktop.yml vendored
View file

@ -443,13 +443,17 @@ jobs:
- name: Install frontend dependencies
working-directory: studio/frontend
# `npm ci` so a release build can never pull a fresh minor/patch
# of a transitive dep from the registry via caret-range resolution;
# the tree is exactly what the committed lockfile pins.
#
# Lifecycle scripts (esbuild native-binary postinstall, etc.) are
# required for `vite build`. The pre-install lockfile structural
# audit (lockfile_supply_chain_audit.py) is the practical defence
# against the npm postinstall-dropper class -- it fires BEFORE any
# tarball runs, on the injection pattern itself rather than an
# advisory-DB lookup.
run: npm install --no-fund --no-audit
run: npm ci --no-fund --no-audit
# ── Rust ──
- name: Install Rust stable