Repository navigation
Make action execution hermetic and reproducible #18
Description
Goal
Make the reusable actions execute the exact dependency graph that was reviewed and tested.
Current gap
The composite actions run npm install --ignore-scripts at execution time and the repository currently has no committed package-lock.json. Direct dependencies are exact, but transitive resolution can still change between CI validation and consumer execution.
Target
Prefer a runtime artifact that does not resolve package dependencies dynamically.
Evaluate in this order:
- commit a lockfile and use
npm ci --ignore-scriptseverywhere; - build and verify deterministic
dist/output; - if practical, make the reusable action execute prebuilt/bundled JavaScript so consumers do not install development dependencies at runtime.
Quality requirements
- Dependabot updates the lockfile;
- REUSE metadata covers generated dependency metadata appropriately;
- CI fails when
package.jsonand lockfile diverge; - CI verifies committed/bundled output matches source;
- consumers remain pinned to immutable action SHAs;
- no package lifecycle scripts run during action execution.
Note
This is a hardening follow-up and should not block the first v0.1.0 release mechanism.
Activity
vitormattos commentedon Sep 20, 2026
Architecture review confirmed that both reusable composite actions and the TypeScript/Vitest CI currently resolve dependencies with
npm install --ignore-scriptsand there is no committedpackage-lock.json.The next implementation should first generate and review a real lockfile from the current dependency graph, then migrate CI and action runtime installation to
npm ci --ignore-scripts. A later step can evaluate prebuilt/bundled JavaScript to eliminate dependency resolution in consumer runs entirely.I did not commit a synthetic lockfile: lockfile generation must come from npm and be reproducible.
vitormattos commentedon Sep 20, 2026
Implemented and validated in #26.
The reusable governance Actions no longer resolve npm dependencies or build TypeScript at consumer runtime. They now execute the reviewed TypeScript source directly with Node 24, and the source was adjusted to use syntax supported by Node's TypeScript stripping mode.
CI now smoke-tests the exact runtime path before installing development dependencies, while Vitest and TypeScript build/typecheck coverage remain in CI. The merged main commit passed TypeScript, Vitest, CodeQL, actionlint, zizmor and REUSE.
This removes the mutable runtime dependency graph described in this issue, which is stronger than only switching from npm install to npm ci.