fix(ci): resync web lockfile blocking Trivy

[Copilot]

Canonical issue

Root/workspace lockfile drift blocked the trivy job before Trivy could start. The failure was in the repo root Docker build path, not in the Python-only PRs that surfaced it.

Outcome

Security Scan can get past the web workspace install step again and reach Trivy.

• Build path unblocked
  • The canonical lockfile now matches the current apps/web manifest for the OpenTelemetry additions that were missing from the lock.
• Operational result
  • npm ci --workspace=apps/web --production --legacy-peer-deps succeeds inside the root Docker build, so Trivy can execute and emit findings.

RUN npm ci --workspace=apps/web --production --legacy-peer-deps

Scope

• Included:
  • Root workspace lockfile resync for the current apps/web dependency graph
  • Recovery of the Security Scan Docker → npm ci → Trivy path
• Explicitly excluded:
  • Unrelated dependency upgrades
  • Manifest refactors or workflow redesign
  • Merge/deploy decisions
  • Re-run of historical failed jobs

Risk

• Risk level: low
• Failure mode:
  • Lockfile regenerated with unintended package movement outside the current manifest set
• Rollback:
  • Revert the lockfile-only sync commit

Verification

List exact automated and manual checks, tied to the current head SHA 6fda5e8.

• Focused tests
  • npx -y npm@10.8.0 ci --workspace=apps/web --production --legacy-peer-deps
  • docker build -t eventrelay:test -f Dockerfile .
  • trivy image --severity CRITICAL,HIGH --ignore-unfixed eventrelay:test
• Required CI
• Review threads resolved

Production evidence

Not applicable. This change is CI/infrastructure repair for the Security Scan path; no production behavior or deployment surface changes.

Agent handoff

• One canonical issue is linked
• No competing PR implements the same issue
• Acceptance criteria are satisfied
• Required checks pass on the current head
• Human decision is requested only for product, security, irreversible infrastructure, or production approval

• Fixes fix(ci): resync web lockfile blocking Trivy #1657

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
v0-uvai	Ready	Preview, v0	Sep 8, 2026 10:54pm UTC