Lab-2143 CI Fixes - #3
Merged
Merged
Conversation
Pin `socketsecurity` to `2.5.5` in `Security-Reachability.yml` to avoid transient CI failures caused by newly released `@coana-tech/cli` dependencies still inside Socket's package-age cooldown window. Added detailed maintainer guidance on when and how to safely bump the pin, including publish-date checks and rollback instructions if ETARGET/notarget errors return.
Stop configuring npm.pkg.github.com globally in CI setup by removing the Node scope/registry settings from shared workflow setup. Instead, target GitHub Packages explicitly on the GitHub publish command with `--registry`, so installs and other npm operations keep the default npmjs registry while package publication still goes to both registries as intended.
🟢 Coverage Report
|
There was a problem hiding this comment.
Pull request overview
This PR adjusts CI workflows to reduce transient failures in security scanning and to avoid globally overriding npm’s registry configuration during CI, while still publishing the package to GitHub Packages and npm as intended.
Changes:
- Pin
socketsecurityin the reachability workflow to avoid ETARGET/notarget failures caused by too-new transitive npm dependencies. - Stop configuring
npm.pkg.github.comglobally via the shared CI setup action. - Publish to GitHub Packages by explicitly passing
--registry=https://npm.pkg.github.comtonpm publish.
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 3 comments.
| File | Description |
|---|---|
| .github/workflows/Security-Reachability.yml | Pins socketsecurity and adds maintainer guidance to reduce transient reachability scan failures. |
| .github/workflows/Publish.yml | Removes the Node setup scope value as part of de-scoping global registry configuration. |
| .github/workflows/Build.yml | Publishes to GitHub Packages using an explicit --registry argument (instead of global registry config). |
| .github/actions/setup-ci/action.yml | Removes global GitHub Packages registry/scope configuration from shared CI setup. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Add a new `update-reachability-pin` script that fetches PyPI release metadata for `socketsecurity`, selects the latest non-yanked stable version at least 24 hours old, and updates the pinned version in `Security-Reachability.yml`. `validate:package` now runs this updater first, while a new `validate:package:skip-reachability` command preserves CI behavior by avoiding workflow file edits during build validation. The Build workflow was updated to use the skip variant, and the reachability workflow comments now document the automated pinning approach.
Update the Build workflow’s GitHub Packages publish step to explicitly configure `//npm.pkg.github.com/:_authToken` from `NODE_AUTH_TOKEN` before running `npm publish`. This makes authentication explicit and avoids publish failures when npm does not automatically pick up the token from environment alone.
Jonny Pound (JonnyPound90)
approved these changes
Jul 30, 2026
pr0uxx
changed the title
This was referenced Jul 30, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Pinned
socketsecurityto2.5.5inSecurity-Reachability.ymlto avoid transient CI failures caused by newly released@coana-tech/clidependencies still inside Socket's package-age cooldown window. Added detailed maintainer guidance on when and how to safely bump the pin, including publish-date checks and rollback instructions if ETARGET/notarget errors return.Stopped configuring npm.pkg.github.com globally in CI setup by removing the Node scope/registry settings from shared workflow setup. Instead, target GitHub Packages explicitly on the GitHub publish command with
--registry, so installs and other npm operations keep the default npmjs registry while package publication still goes to both registries as intended.Type Of Change
Activities Checklist
Code Quality
Testing And Validation
npm run validate:package.Coverage
Security And Safety
Documentation
Release Impact
Linked Work
Notes For Reviewers
sfw npm ifailing and reachability analysis failing but does not guarantee to fix further step failures in workflows.