Support npm validation with the shared writable Node cache #120

Merged

gitchegumi merged 1 commit from kiyi/npm-node-validation into main

2026-10-17 13:49:12 -05:00

kiyi commented

2026-10-17 13:33:54 -05:00

Member

The existing pnpm runtime/image profiles retain their validation contract. npm script names and regular package/lock files are validated before installation; any failure stops later stages. The adapter supports the existing validate job/status name, Node 22 and 20-minute timeout, without registry/signing/deployment credentials.

Validation: 12 npm/Node tests pass, including failure ordering, cache exports/rejection, existing pnpm behavior and frozen npm adapter compilation. Prepared Documentation callers were compared against their current-main blobs: workflow/job names, triggers, exact npm sequence, actor/environment/OIDC gates and release inputs are preserved; bundle/deploy channel migration and existing organization registry bindings are prepared locally. Staged default-rule Gitleaks 8.30.1 and diff checks pass. All five published blobs match local staged content; author and committer are kiyi kiyi@gitchegumi.com. The broader channel suite could not be accepted locally because of Windows Bash/Git/temp restrictions and uncommitted new-adapter HEAD discovery; required hosted Library checks remain necessary.

After review, release and stable-v1 promotion, adopt the prepared thin Documentation callers and verify hosted Node/npm execution and emitted check names. Callers are held until the new adapter exists in the channel. No manual workflow, library release/promotion or deployment was dispatched.

Tracks #119 and Homelab/Documentation#56. Failure: https://git.gitchegumi.com/Homelab/Documentation/actions/runs/349/jobs/0/attempt/1

Documentation bundle run 349 stopped in setup-node with EACCES creating /opt/hostedtoolcache, before npm installation or bundle building. Add a reusable npm validation entry point that uses the existing writable-cache helper before Node setup. Preserve npm ci, npm run check, the optional existing check:deployment:published gate and npm run build. No package-manager migration is required. The existing pnpm runtime/image profiles retain their validation contract. npm script names and regular package/lock files are validated before installation; any failure stops later stages. The adapter supports the existing validate job/status name, Node 22 and 20-minute timeout, without registry/signing/deployment credentials. Validation: 12 npm/Node tests pass, including failure ordering, cache exports/rejection, existing pnpm behavior and frozen npm adapter compilation. Prepared Documentation callers were compared against their current-main blobs: workflow/job names, triggers, exact npm sequence, actor/environment/OIDC gates and release inputs are preserved; bundle/deploy channel migration and existing organization registry bindings are prepared locally. Staged default-rule Gitleaks 8.30.1 and diff checks pass. All five published blobs match local staged content; author and committer are kiyi <kiyi@gitchegumi.com>. The broader channel suite could not be accepted locally because of Windows Bash/Git/temp restrictions and uncommitted new-adapter HEAD discovery; required hosted Library checks remain necessary. After review, release and stable-v1 promotion, adopt the prepared thin Documentation callers and verify hosted Node/npm execution and emitted check names. Callers are held until the new adapter exists in the channel. No manual workflow, library release/promotion or deployment was dispatched. Tracks #119 and Homelab/Documentation#56. Failure: https://git.gitchegumi.com/Homelab/Documentation/actions/runs/349/jobs/0/attempt/1

kiyi added 1 commit

2026-10-17 13:33:54 -05:00

Support npm validation with the shared writable Node cache

Workflow acceptance / acceptance (pull_request) Successful in 1m25s

Details

Repository security / security-1 (pull_request) Successful in 5m53s

Details

Library checks / tests (pull_request) Successful in 8m2s

Details

08ca92a040

portegumi approved these changes

2026-10-17 13:35:07 -05:00

portegumi left a comment

I reviewed the exact-head npm adapter, the complete changed Node planner and tests, and the docs. The workflow runs the existing writable-cache helper before setup-node, freezes the released library checkout, and delegates to the planner for npm ci → check → optional existing additional check → build. The planner rejects missing/linked package or lock inputs and missing or malformed script names before installation, invokes commands without a shell and fails on the first nonzero result. The existing pnpm path remains present; tests cover ordering, failure propagation, cache/setup ordering and channel compilation. This PR does not change a UDS deployment package, policy, gateway or route; it adds a validation entry point only. No source blocker found. Library checks, workflow acceptance and repository security were pending at review time; approval is source-only and does not waive those required merge gates or establish hosted npm acceptance. The changed-files API supplied no patch hunks, so the assessment used the authenticated full changed-file source at this head.

CI at submission: pending. This is a source-review approval, not a scan verdict; required checks still block merge.

kiyi referenced this pull request from Homelab/Documentation

2026-10-17 13:35:34 -05:00

Render the DNS ingress flow and add an overall architecture chart #56