From d19e301b4c2db47347dbdde81ad6520718b97bb8 Mon Sep 17 00:00:00 2001 From: Roger Chappel Date: Wed, 26 Aug 2026 02:38:45 +1000 Subject: [PATCH 1/3] build: pin supported install toolchain --- package-lock.json | 3 ++- package.json | 4 +++- 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/package-lock.json b/package-lock.json index 7ba5233..83c4924 100644 --- a/package-lock.json +++ b/package-lock.json @@ -16,7 +16,8 @@ "typescript": "^5.9.3" }, "engines": { - "node": ">=20" + "node": ">=20 <25", + "npm": ">=10 <11" } }, "node_modules/@types/node": { diff --git a/package.json b/package.json index 70a1a09..e64a6f9 100644 --- a/package.json +++ b/package.json @@ -42,12 +42,14 @@ ], "author": "Roger Chappel", "license": "MIT", + "packageManager": "npm@10.9.4", "devDependencies": { "@types/node": "^25.0.0", "typescript": "^5.9.3" }, "engines": { - "node": ">=20" + "node": ">=20 <25", + "npm": ">=10 <11" }, "repository": { "type": "git", From 2300cca38dab5321d116918b9fadbb0483845cbe Mon Sep 17 00:00:00 2001 From: Roger Chappel Date: Wed, 26 Aug 2026 02:38:45 +1000 Subject: [PATCH 2/3] ci: verify pinned installs through Node 24 --- .github/workflows/ci.yml | 13 +++++++------ .github/workflows/release-dry-run.yml | 4 ++-- .github/workflows/release.yml | 4 ++-- 3 files changed, 11 insertions(+), 10 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 9d77a4a..adfc10b 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -6,15 +6,16 @@ on: jobs: test: runs-on: ubuntu-latest + strategy: + fail-fast: false + matrix: + node-version: [20, 22, 24] steps: - uses: actions/checkout@v4 - uses: actions/setup-node@v4 with: - node-version: 22 + node-version: ${{ matrix.node-version }} cache: npm - - run: npm ci - - run: npm test - - run: npm run check - - run: npm run build - - run: npm run smoke + - run: npx --yes npm@10.9.4 ci + - run: npx --yes npm@10.9.4 run release:check - run: bash scripts/validate.sh diff --git a/.github/workflows/release-dry-run.yml b/.github/workflows/release-dry-run.yml index 7272da7..029a7b5 100644 --- a/.github/workflows/release-dry-run.yml +++ b/.github/workflows/release-dry-run.yml @@ -28,7 +28,7 @@ jobs: node-version: 22 cache: npm - name: Install dependencies - run: npm ci + run: npx --yes npm@10.9.4 ci - name: Install ReleaseBox run: | set -euo pipefail @@ -38,7 +38,7 @@ jobs: - name: ReleaseBox readiness check run: node /tmp/releasebox/bin/releasebox.js check . - name: Run release checks - run: npm run release:check + run: npx --yes npm@10.9.4 run release:check - name: Release notes preview run: | node /tmp/releasebox/bin/releasebox.js notes . > release-notes-preview.md diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 6454134..cf4f5eb 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -26,7 +26,7 @@ jobs: cache: npm registry-url: https://registry.npmjs.org - name: Install dependencies - run: npm ci + run: npx --yes npm@10.9.4 ci - name: Verify release tag matches package version run: node scripts/verify-release-tag.mjs - name: Install ReleaseBox @@ -38,7 +38,7 @@ jobs: - name: ReleaseBox readiness check run: node /tmp/releasebox/bin/releasebox.js check . - name: Run release checks - run: npm run release:check + run: npx --yes npm@10.9.4 run release:check - name: Build package run: npm pack - name: Generate release notes From fda5f18647429a7d0f8394c37825cf060963b744 Mon Sep 17 00:00:00 2001 From: Roger Chappel Date: Wed, 26 Aug 2026 02:38:45 +1000 Subject: [PATCH 3/3] docs: define deterministic install contract --- README.md | 11 ++++++----- docs/ORCHESTRATION.md | 2 +- docs/orchestration.json | 2 +- 3 files changed, 8 insertions(+), 7 deletions(-) diff --git a/README.md b/README.md index d79f99c..0be7869 100644 --- a/README.md +++ b/README.md @@ -124,12 +124,13 @@ The matching recording outline is ## Verify +Development supports Node.js 20, 22, and 24 with npm 10. The repository pins +npm 10.9.4 so clean installs use the same lockfile implementation locally and +in CI. + ```sh -npm install -npm test -npm run check -npm run build -npm run smoke +npx --yes npm@10.9.4 ci +npx --yes npm@10.9.4 run release:check bash scripts/validate.sh ``` diff --git a/docs/ORCHESTRATION.md b/docs/ORCHESTRATION.md index aad2045..418e3d0 100644 --- a/docs/ORCHESTRATION.md +++ b/docs/ORCHESTRATION.md @@ -2,6 +2,6 @@ Workstreams: product contract, core implementation, quality gates, and publishing setup. -Verification gates: `npm install`, `npm test`, `npm run check`, `npm run build`, `npm run smoke`, `bash scripts/validate.sh`, and a real fixture-backed CLI smoke. +Verification gates: `npx --yes npm@10.9.4 ci`, `npx --yes npm@10.9.4 run release:check`, `bash scripts/validate.sh`, and a real fixture-backed CLI smoke on supported Node.js 20, 22, and 24 runtimes. Release posture: usable MVP at `0.1.0`; publishing remains explicit and validation-first. diff --git a/docs/orchestration.json b/docs/orchestration.json index 43272dc..7d753e9 100644 --- a/docs/orchestration.json +++ b/docs/orchestration.json @@ -1 +1 @@ -{"project":"clipcase","source":"docs/PRD.md","status":"mvp-complete","commands":["init","new","add","list","show","search","export"],"storage":{"default":".clipcase","configFile":".clipcase.json","entryFormat":"markdown","indexFormat":"json"},"qualityGates":["npm install","npm test","npm run check","npm run build","npm run smoke","bash scripts/validate.sh"],"security":{"secretBlocking":true,"overrideFlag":"--allow-secret","networkRequired":false}} +{"project":"clipcase","source":"docs/PRD.md","status":"mvp-complete","commands":["init","new","add","list","show","search","export"],"storage":{"default":".clipcase","configFile":".clipcase.json","entryFormat":"markdown","indexFormat":"json"},"qualityGates":["npx --yes npm@10.9.4 ci","npx --yes npm@10.9.4 run release:check","bash scripts/validate.sh"],"security":{"secretBlocking":true,"overrideFlag":"--allow-secret","networkRequired":false}}