Point the existing audit + install + content-sanity workflows at
the two lockfiles PR #5604 introduced (studio/package-lock.json
and studio/backend/core/data_recipe/oxc-validator/package-lock.json)
so the Studio Tauri CLI holder and the oxc-validator runtime
benefit from the same per-PR coverage the frontend already has.
release-desktop.yml:
- Tauri CLI install: `npm install --save-dev --prefix studio` ->
`npm ci --prefix studio --no-fund --no-audit`.
- Frontend install: `npm install --no-fund --no-audit` ->
`npm ci --no-fund --no-audit`.
- New "Lockfile supply-chain audit" step inserted BEFORE the
Tauri CLI install so the structural audit fires before any
tarball-side lifecycle script.
studio-tauri-smoke.yml:
- Tauri CLI install: `npm install --save-dev --prefix studio` ->
`npm ci --prefix studio --no-fund --no-audit`.
- Existing audit step relocated to run BEFORE the Tauri CLI
install (same ordering rationale).
wheel-smoke.yml:
- One-line content-sanity assertion ensuring the oxc-validator
package-lock.json is shipped in the wheel.
security-audit.yml:
- `paths` trigger gains the 4 new entries (oxc + Tauri CLI
holder package.json + package-lock.json).
- `Scanned:` summary string updated to list the two new
lockfiles.
- OSV-scanner picks up `--lockfile=` for both.
- Two new `npm audit` steps: oxc-validator runtime + Studio
Tauri CLI holder.
- `npm audit signatures` block split into three (frontend / oxc
/ Tauri CLI), each preceded by `npm ci --ignore-scripts` in
its own directory.
- `check_new_install_scripts.py` invocation extended to diff
both new lockfiles base->head, with `git show ... 2>/dev/null
|| echo '{}'` fallback for PRs whose base predates #5604.
- `upload-artifact` paths extended for the new log files.
Deliberately NOT included: removing `continue-on-error` from the
existing `scan_npm_packages` job. That is a policy flip from
advisory to blocking and is orthogonal to install-path hardening.
5cfbb7b6cf