From 6a31fb296f1edb840bb83bb8c66b5059d74b061e Mon Sep 17 00:00:00 2001 From: cesnimda Date: Thu, 27 Aug 2026 21:32:32 +0200 Subject: [PATCH] fix(ci): isolate npm install caches --- .gitea/workflows/ci-deploy.yml | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-) diff --git a/.gitea/workflows/ci-deploy.yml b/.gitea/workflows/ci-deploy.yml index 9a0d2ce..c35111e 100644 --- a/.gitea/workflows/ci-deploy.yml +++ b/.gitea/workflows/ci-deploy.yml @@ -54,8 +54,6 @@ jobs: uses: actions/setup-node@v4 with: node-version: '20' - cache: 'npm' - cache-dependency-path: job-tracker-ui/package-lock.json - name: Test repository safety scripts # Standard-library only and plan-only: this validates the synthetic benchmark harness @@ -118,12 +116,15 @@ jobs: run: | node -v npm -v - # npm ci occasionally segfaults on the runner (SIGSEGV/139, a memory/native - # flake). Retry once with a clean node_modules before failing the job. - npm ci --no-audit --no-fund \ + # The runner's shared npm cache has returned checksum-invalid tarballs and + # injected control bytes into installed JS. Give each attempt an isolated + # cache so a poisoned archive cannot survive into this checkout or retry. + npm_cache="$(mktemp -d)" + npm ci --no-audit --no-fund --cache "$npm_cache" \ || ( echo "npm ci failed ($?) — cleaning node_modules and retrying once..." \ && rm -rf node_modules \ - && npm ci --no-audit --no-fund ) + && npm_cache="$(mktemp -d)" \ + && npm ci --no-audit --no-fund --cache "$npm_cache" ) # Moderate React Router advisories remain documented and mitigated; high/critical findings # in either production or test/browser tooling block the build. @@ -156,8 +157,8 @@ jobs: echo "Browser smoke failed ($smoke_status) — rebuilding the browser runtime and retrying once..." rm -rf node_modules - npm cache verify - npm ci --no-audit --no-fund --prefer-online + recovery_cache="$(mktemp -d)" + npm ci --no-audit --no-fund --cache "$recovery_cache" npx playwright install --with-deps --force chromium npm run test:e2e