Uh oh!
There was an error while loading. Please reload this page.
perf(setup): disable npm audit and fund in CI - #53
Merged
Conversation
npm install is the largest remaining cost in these jobs, and it is almost entirely the audit — a network round trip over the whole dependency tree on every run, even when node_modules was restored intact: snellmanrecipes up to date, audited 1716 packages in 48s beamex up to date, audited 1880 packages in 60s kaskipuu up to date, audited 1930 packages in 1m Locally on a 1250-package tree: 9s with audit, 1s without. Set via npm config rather than CLI flags so it covers every npm invocation, including the ones inside projects' composer build scripts, which is where these installs actually happen. Dependency vulnerabilities are covered by the nightly vulnerability scan, which gates and opens PRs. npm's install-time audit summary gates nothing. The internal setup ref is temporarily pointed at this branch to verify; that is reverted before merge. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
oxyc pushed a commit
that referenced
this pull request
Jul 30, 2026
This branch carried uses: generoi/github-actions/setup@perf/npm-no-audit which is #53's verification branch, picked up from master when this branch was cut. #53 has since merged, so the ref is both unnecessary and wrong: leaving it would point every consumer of the shared test workflow at a feature branch instead of the release tag. Restored from master. Nothing else in this branch touches test.yml — the actual change here is confined to composer-update/tests/lib.sh. master and the v1/v2 tags were checked and both already carry @v1, so this never reached downstream. Second instance of this pattern; the first was a "tmp: point internal setup ref at this branch for verification" commit carrying setup@fix/drop-vendor-cache, caught and reverted before #50 was opened. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
oxyc pushed a commit
that referenced
this pull request
Jul 30, 2026
…he-integrity * origin/master: perf(setup): disable npm audit and fund in CI (#53)
oxyc added a commit
that referenced
this pull request
Jul 30, 2026
* perf(setup): disable npm audit and fund in CI npm install is the largest remaining cost in these jobs, and it is almost entirely the audit — a network round trip over the whole dependency tree on every run, even when node_modules was restored intact: snellmanrecipes up to date, audited 1716 packages in 48s beamex up to date, audited 1880 packages in 60s kaskipuu up to date, audited 1930 packages in 1m Locally on a 1250-package tree: 9s with audit, 1s without. Set via npm config rather than CLI flags so it covers every npm invocation, including the ones inside projects' composer build scripts, which is where these installs actually happen. Dependency vulnerabilities are covered by the nightly vulnerability scan, which gates and opens PRs. npm's install-time audit summary gates nothing. The internal setup ref is temporarily pointed at this branch to verify; that is reverted before merge. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix(tests): verify the semver cache works, not just that it exists Three of six composer-update test files were red on master. All three had the same cause, and none of the symptoms pointed at it. ensure_semver_vendor caches a composer/semver vendor dir and guarded it with if [ ! -f "$cache/vendor/autoload.php" ]; then ... build ... fi Existence is too weak. An interrupted `composer require` leaves autoload.php and vendor/composer/ behind WITHOUT vendor/composer/ClassLoader.php — the local cache here had exactly that shape, with composer/semver present but the autoloader's own class file missing. The guard was satisfied, so the cache was never rebuilt: every run copied a broken autoloader into the test project, the PHP helpers fatally errored on the missing ClassLoader, and their non-JSON output reached jq as jq: parse error: Invalid numeric literal at line 2, column 8 which reads like a bug in the helper's JSON, not a missing dependency. The partial cache is also sticky — once in that state it stays broken across every future run. Now the guard actually exercises the cache: require the autoloader and check Composer\Semver\Semver resolves. If it does not, the cache is deleted and rebuilt from scratch rather than built on top of a partial tree, and the loud-failure path reports a *working* bootstrap could not be produced. Suite goes from 3 of 6 files failing to 6 of 6 passing, with no change to any assertion or to the scripts under test. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix(ci): restore setup@v1 — the temporary ref belonged to #53 This branch carried uses: generoi/github-actions/setup@perf/npm-no-audit which is #53's verification branch, picked up from master when this branch was cut. #53 has since merged, so the ref is both unnecessary and wrong: leaving it would point every consumer of the shared test workflow at a feature branch instead of the release tag. Restored from master. Nothing else in this branch touches test.yml — the actual change here is confined to composer-update/tests/lib.sh. master and the v1/v2 tags were checked and both already carry @v1, so this never reached downstream. Second instance of this pattern; the first was a "tmp: point internal setup ref at this branch for verification" commit carrying setup@fix/drop-vendor-cache, caught and reverted before #50 was opened. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> --------- Co-authored-by: test <test@example.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: genero-bot <dev@genero.fi>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
npm installis the largest remaining cost in these jobs, and it is almost entirely the audit — a network round trip over the whole dependency tree on every run, even whennode_moduleswas restored intact.The evidence
Across the three most expensive repos, all with
node_modulesrestored:up to date, audited 1716 packages in48sup to date, audited 1880 packages in60sup to date, audited 1930 packages in1msnellmanrecipes' warm build is ~3s — the same as suomentyokalu's. It looked slower than the others purely because of this.
Measured end to end
Verified on snellmanrecipes by pinning both the caller and the internal
setup@ref at this branch, withnode_moduleswarm in both runs:Install development packagesAgainst that repo's original 261s, this and the webpack filesystem cache together are −69%.
Why npm config rather than CLI flags
These installs happen inside projects' own
composer buildscripts (npm install && npm run build:production). Passing--no-auditwould mean editing 19 composer.json files; setting it as npm config covers every invocation on the runner, so beamex and kaskipuu get ~60s back without any per-repo change.Is dropping the audit safe
Yes. Dependency vulnerabilities are covered by the nightly vulnerability scan, which actually gates and opens PRs. npm's install-time audit summary gates nothing — it prints, and the build continues either way.
npm auditremains available on demand.🤖 Generated with Claude Code