From 1f6fe08476be230b4889b4923474c708f8065ae5 Mon Sep 17 00:00:00 2001 From: Rob Gilbreath Date: Thu, 3 Sep 2026 12:46:14 -0800 Subject: [PATCH] =?UTF-8?q?ci:=20shared-actions=20v3.1.0=20=E2=80=94=20a?= =?UTF-8?q?=20skipped=20install=20script=20fails=20validate?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit pncit/shared-actions#35: the `Audit skipped install scripts` step in validate-codebase is now fatal. This repo declares `allowScripts` (pncit/.github#24), so nothing changes today; from here a dependency bump that brings a new or re-versioned install script reds `validate` with the fix in the error text instead of scrolling past as a warning. CI-only change (.github/** is exempt from the version-bump gate). --- .github/actions/README.md | 2 +- .github/actions/validate-codebase/action.yml | 13 ++++++++----- .github/actions/verify-version-bump/action.yml | 2 +- 3 files changed, 10 insertions(+), 7 deletions(-) diff --git a/.github/actions/README.md b/.github/actions/README.md index 40e5681..4a5c8b5 100644 --- a/.github/actions/README.md +++ b/.github/actions/README.md @@ -2,7 +2,7 @@ These are **local mirrors** (vendored copies) of composite actions from the private [`pncit/shared-actions`](https://github.com/pncit/shared-actions) repo, -currently at `v3.0.0` (`8bc187e`). +currently at `v3.1.0` (`4281e5b`). ## Why they're copied here diff --git a/.github/actions/validate-codebase/action.yml b/.github/actions/validate-codebase/action.yml index d62c0be..97074f2 100644 --- a/.github/actions/validate-codebase/action.yml +++ b/.github/actions/validate-codebase/action.yml @@ -19,7 +19,7 @@ description: >- # directly from a job's `steps:` with the npm-token and the two toolchain # versions (`vars.NODE_VERSION`, `vars.NPM_VERSION`). -# Vendored from pncit/shared-actions@v3.0.0 (8bc187e) because this repo is PUBLIC +# Vendored from pncit/shared-actions@v3.1.0 (4281e5b) because this repo is PUBLIC # and shared-actions is PRIVATE — a public repo can't `uses:` a private # action. Byte-for-byte identical to upstream apart from this comment; # re-copy when upstream changes (see .github/actions/README.md). @@ -150,15 +150,18 @@ runs: # string `allowScripts`, so matching that catches the block and also # gives early warning on a runner still effectively on npm 11. # - # Warning, not error, on purpose: most pncit repos have no - # `allowScripts` field yet, and failing here would red them all at - # once. Flip to ::error:: once the org-wide rollout lands. + # Fatal since v3.1.0: every pncit Node repo declares `allowScripts` + # (pncit/.github#24), so a hit here means a dependency bump brought a + # new or re-versioned install script that nobody has looked at yet. + # The fix is the one the message gives -- approve or deny it in + # package.json -- not to loosen this step. - name: Audit skipped install scripts shell: bash run: | if grep -q 'allowScripts' "${RUNNER_TEMP}/npm-ci.log"; then grep 'allowScripts' "${RUNNER_TEMP}/npm-ci.log" >&2 - echo "::warning::npm flagged or skipped one or more install scripts. If any is a native module, it did not build and the install still reported success. Approve with: npx npm@${NPM_VERSION} install-scripts approve , then commit the package.json allowScripts change." + echo "::error::npm flagged or skipped one or more install scripts. If any is a native module, it did not build and the install still reported success. Review with: npx npm@${NPM_VERSION} install-scripts ls, then approve (or deny ) and commit the package.json allowScripts change." + exit 1 fi env: NPM_VERSION: ${{ inputs.npm-version }} diff --git a/.github/actions/verify-version-bump/action.yml b/.github/actions/verify-version-bump/action.yml index 4e14ea6..c215848 100644 --- a/.github/actions/verify-version-bump/action.yml +++ b/.github/actions/verify-version-bump/action.yml @@ -36,7 +36,7 @@ description: >- # Does its own checkout (fetch-depth 2 plus a fetch of the reference), so it # can run first in a job; a later validate-codebase will check out again. -# Vendored from pncit/shared-actions@v3.0.0 (8bc187e) because this repo is PUBLIC +# Vendored from pncit/shared-actions@v3.1.0 (4281e5b) because this repo is PUBLIC # and shared-actions is PRIVATE — a public repo can't `uses:` a private # action. Byte-for-byte identical to upstream apart from this comment; # re-copy when upstream changes (see .github/actions/README.md).