Jordan Ritter e906d0f631 ci: replace ad-hoc tool installs with lockfile/pinned-action installs (zizmor adhoc-packages) ...

Four workflow steps installed CLI tools ad-hoc via `npm install -g`, which
zizmor's `adhoc-packages` audit flags (install outside a lockfile). Replace
each with a lockfile-managed or pinned-action install, preserving behavior:

- aimock (test_integration-docs, test_e2e-showcase-on-demand): invoke the
  workspace-pinned @copilotkit/aimock `llmock` bin from the frozen lockfile
  (already a dep of @copilotkit/showcase-scripts) instead of `npm install -g`.
  Kept lockfile-devDep rather than the CopilotKit/aimock composite action:
  the action wraps the newer config-only `aimock` CLI and can't do the
  multi-`--fixtures` / `--validate-on-load` / `/__aimock/health` invocation
  these jobs need.
- claude-code (social_copy-generator): pin @anthropic-ai/claude-code as a root
  devDependency, install from the frozen lockfile, invoke via its documented
  cli-wrapper.cjs entrypoint. Kept lockfile-devDep rather than
  anthropics/claude-code-action: the job uses claude as a scripted `-p` CLI,
  not PR/issue automation.
- oxfmt (static_quality): already a root devDependency; install from the frozen
  lockfile and put node_modules/.bin on PATH instead of `npm install -g`.
- ruff (static_quality): switch `pipx install` to the pinned official
  astral-sh/ruff-action@278981a (v4.1.0) with the same 0.15.13 version.

zizmor --min-severity low --config .github/zizmor.yml .github/workflows:
  before: exit 12, 4 adhoc-packages findings
  after:  exit 0,  0 adhoc-packages findings, 0 unpinned-uses (no findings)

2026-07-11 19:19:45 -07:00

6.2 KiB

Raw Permalink Blame History

View Raw