CI: enforce reproducible dependency installs

[BigSimmo]

Summary

• Replace node_modules caching with npm download-cache reuse plus a clean npm ci --include=dev on every CI runner.
• Extend installed-lock parity to the lint and unit-test toolchain.
• Clarify the ops-digest secret preflight and clean-checkout install contract.

Sources reviewed

#1313, #1328, #1329, #1346, #1350.

Retained

Reproducible installs, explicit dev-dependency installs, npm cache safety, installed-toolchain parity, and the valid ops preflight wording.

Rejected

Fail-open upload auditing, duplicate/image-contaminated assets, unused image APIs, visual-regression machinery without baselines, test-coordinator bypasses, and the primary-checkout guard whose stale-owner recovery had a lease-deletion race.

Verification

• git diff --check
• focused Vitest: 2 files, 8 tests passed
• npm run check:github-actions
• npm run check:installed-lock-parity
• npm run verify:cheap: passed; 412 test files, 4199 tests passed, 3 skipped

Not run

No hosted CI reruns and no provider-backed checks.

Risk

CI jobs now reinstall node_modules on each fresh runner, trading some runtime for deterministic lockfile proof.

RAG impact: no retrieval behaviour change - the eval workflow change only makes dependency installation explicit.

Summary by CodeRabbit

• CI Improvements

  • Dependency installation now consistently includes development tools across automated checks.
  • CI uses npm’s package download cache while performing clean, reproducible installs.

• Bug Fixes

  • Expanded dependency verification to detect version mismatches for ESLint and Vitest.

• Documentation

  • Clarified the recommended clean-install workflow and when to use dependency updates.
  • Documented stricter environment preflight behavior.

• Tests

  • Updated coverage to validate the revised caching and dependency-parity checks.

[supabase]

This pull request has been ignored for the connected project sjrfecxgysukkwxsowpy because there are no changes detected in supabase directory. You can change this behaviour in Project Integrations Settings ↗︎.

---

Preview Branches by Supabase.
Learn more about Supabase Branching ↗︎.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: fcea7f97-4068-4278-ae70-ccc8d3b25bfd

📥 Commits

Reviewing files that changed from the base of the PR and between 18bed6d and aa178d6.

📒 Files selected for processing (11)

• .github/actions/setup-node-cached/action.yml
• .github/workflows/dependency-report.yml
• .github/workflows/eval-canary.yml
• .github/workflows/ingestion-autopilot.yml
• .github/workflows/live-drift.yml
• .github/workflows/ops-digest.yml
• .github/workflows/staging-tenancy.yml
• README.md
• scripts/check-installed-lock-parity.mjs
• tests/ci-cache-safety.test.ts
• tests/installed-lock-parity.test.ts

---

📝 Walkthrough

Walkthrough

The PR replaces cached node_modules restoration with npm download caching, standardizes CI and setup installs on npm ci --include=dev, updates related documentation and workflow comments, and expands installed-lock parity checks to include eslint and vitest.

Changes

Dependency installation and validation

Layer / File(s)	Summary
npm cache setup and cache safety .github/actions/setup-node-cached/action.yml, tests/ci-cache-safety.test.ts	The reusable setup action uses npm download caching, always installs development dependencies, and tests ensure node_modules is neither cached nor reused.
Workflow and setup install standardization .github/workflows/*.yml, README.md	CI workflows and setup instructions use npm ci --include=dev; the ops workflow comment documents fail-closed preflight behavior.
Critical package parity coverage scripts/check-installed-lock-parity.mjs, tests/installed-lock-parity.test.ts	Installed-lock parity checks now include eslint and vitest, with tests covering the expanded package list.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related PRs

• BigSimmo/Database#452: Overlaps on dependency installation changes in GitHub workflows, including live-drift.
• BigSimmo/Database#618: Also modifies the dependency installation step in dependency-report.yml.
• BigSimmo/DSM-5-Diagnosis#39: Modifies GitHub Actions Node setup and dependency caching behavior.

Suggested labels:dependencies, github_actions

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the main change: making CI dependency installs reproducible.
Description check	✅ Passed	The description covers summary, verification, risk, and rollout context well, though Rollback and provider effects are not fully filled out.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

---

_{Comment @coderabbitai help to get the list of available commands.}