From 48911054f3ee2a3345f632186bc5768fb01bb0d2 Mon Sep 17 00:00:00 2001 From: MGrin Date: Fri, 21 Aug 2026 11:12:07 +0800 Subject: [PATCH 1/2] ci(test): install the lockfile exactly, so CI tests what a clone gets (MX-222) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `npm install` may resolve a version the lockfile does not pin and will happily run against a package.json the lockfile no longer matches. `npm ci` fails on that disagreement, which is the one extra thing this job can check for free. Swept from MX-222 (bb-plugin-accounts). This repo already had the Test job — MX-228 added it — so this is the only difference between the three plugins' gates. Verified locally: `npm ci` + typecheck + `npm test` all exit 0. Co-Authored-By: Claude Opus 5 (1M context) --- .github/workflows/test.yml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 3bfb808..52e0bcc 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -24,6 +24,9 @@ jobs: - uses: actions/setup-node@v4 with: node-version: "22" - - run: npm install --no-audit --no-fund + # `npm ci` rather than `npm install`: it installs the lockfile exactly + # and fails when package.json and package-lock.json disagree, so CI + # tests the tree a fresh clone would get (MX-222). + - run: npm ci --no-audit --no-fund - run: npm run typecheck - run: npm test From 43acb9e0d49b0f55645e8212221ba13cdee6102c Mon Sep 17 00:00:00 2001 From: MGrin Date: Fri, 21 Aug 2026 11:14:39 +0800 Subject: [PATCH 2/2] =?UTF-8?q?test:=20NEGATIVE=20CONTROL=20=E2=80=94=20a?= =?UTF-8?q?=20version=20that=20EXISTS=20but=20the=20lockfile=20does=20not?= =?UTF-8?q?=20pin?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- package.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/package.json b/package.json index 523d685..ddbdc63 100644 --- a/package.json +++ b/package.json @@ -24,7 +24,7 @@ "better-sqlite3": "^12.0.0", "hono": "^4.11.9", "typescript": "^5.7.0", - "zod": "^4.3.6" + "zod": "^3.25.0" }, "license": "MIT", "repository": {