From be892ee9d44b46930763f5db42ef7a5b90bfd942 Mon Sep 17 00:00:00 2001 From: "Joseph T. French" Date: Wed, 9 Sep 2026 12:23:11 -0500 Subject: [PATCH] fix(ci): install from the lockfile `npm install` re-resolved the peer dependencies on every CI run, so an upstream publish could turn main red between a PR's green run and its merge. It did today: react-dom 19.3.0 was published two minutes before react 19.3.0, and the merge of #64 landed in between. `npm ci` installs exactly what the lockfile says, in both the test and publish workflows. Claude-Session: https://claude.ai/code/session_01Wrb85mvgMjYTHHSkKWFre4 --- .github/workflows/publish.yml | 6 +++++- .github/workflows/test.yml | 6 +++++- 2 files changed, 10 insertions(+), 2 deletions(-) diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 7cb2785..ae3058c 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -52,7 +52,11 @@ jobs: - name: Install dependencies if: steps.check-published.outputs.already_published == 'false' - run: npm install + # npm ci installs exactly what the lockfile says. `npm install` re-resolved + # peers on every run, so an upstream publish could break CI between a + # PR's green run and its merge (2026-09-09: react-dom 19.3.0 arrived + # two minutes before react 19.3.0 did). + run: npm ci - name: Build if: steps.check-published.outputs.already_published == 'false' diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 763a1b2..73f6dab 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -42,7 +42,11 @@ jobs: run: npm install -g npm@11 - name: Install dependencies - run: npm install + # npm ci installs exactly what the lockfile says. `npm install` re-resolved + # peers on every run, so an upstream publish could break CI between a + # PR's green run and its merge (2026-09-09: react-dom 19.3.0 arrived + # two minutes before react 19.3.0 did). + run: npm ci - name: Check formatting run: npm run format:check