(maka) 01/01: fix(release): decouple Nightly from registry audit

[as...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

Astro-Han pushed a commit to branch fix/nightly-audit-boundary
in repository https://gitbox.apache.org/repos/asf/maka.git

commit 7fb705dbbe489478b0fe3c11eedd9abdb498c626
Author: AstroHan <le...@outlook.com>
AuthorDate: Fri Sep 4 09:48:59 2026 +0800

    fix(release): decouple Nightly from registry audit
    
    Generated-by: Codex
---
 .github/workflows/desktop-nightly.yml            |  9 ++-------
 .github/workflows/npm-publication.yml            |  2 +-
 scripts/desktop-nightly-workflow-policy.test.mjs | 25 ++++++++++++++++++++++++
 scripts/release-cli-package.mjs                  |  6 ++++--
 4 files changed, 32 insertions(+), 10 deletions(-)

diff --git a/.github/workflows/desktop-nightly.yml b/.github/workflows/desktop-nightly.yml
index 9616f9d957..12538c08cb 100644
--- a/.github/workflows/desktop-nightly.yml
+++ b/.github/workflows/desktop-nightly.yml
@@ -129,12 +129,7 @@ jobs:
           cache: npm
 
       - name: Install dependencies
-        run: npm ci
-
-      - name: Audit the shipped Desktop dependency closure
-        run: |
-          npm audit --omit=dev --audit-level=moderate
-          node scripts/audit-shipped-dependencies.mjs
+        run: npm ci --no-audit
 
       - name: Update stable Rust for native Desktop artifacts
         run: rustup update stable --no-self-update
@@ -254,7 +249,7 @@ jobs:
           cache: npm
 
       - name: Install publisher dependencies
-        run: npm ci --ignore-scripts
+        run: npm ci --ignore-scripts --no-audit
 
       - name: Download every verified Desktop build
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
diff --git a/.github/workflows/npm-publication.yml b/.github/workflows/npm-publication.yml
index 1fc32f99a1..86b0dd335f 100644
--- a/.github/workflows/npm-publication.yml
+++ b/.github/workflows/npm-publication.yml
@@ -123,7 +123,7 @@ jobs:
           cache: npm
 
       - name: Install publisher dependencies
-        run: npm ci --ignore-scripts
+        run: npm ci --ignore-scripts --no-audit
 
       - name: Select the publication npm toolchain
         run: npm install --global --no-audit --no-fund "$(node -p 'require("./package.json").packageManager')"
diff --git a/scripts/desktop-nightly-workflow-policy.test.mjs b/scripts/desktop-nightly-workflow-policy.test.mjs
index 5c561cf47d..6b0f72c959 100644
--- a/scripts/desktop-nightly-workflow-policy.test.mjs
+++ b/scripts/desktop-nightly-workflow-policy.test.mjs
@@ -57,6 +57,31 @@ test('npm publication owns both npm channels and no Desktop authority', async ()
   assert.doesNotMatch(JSON.stringify(workflow), /NODE_AUTH_TOKEN|NPM_TOKEN/u);
 });
 
+test('Nightly packaging does not depend on the registry audit service', async () => {
+  const formal = await readWorkflow('release-cli-stage.yml');
+  assert.equal(formal.jobs.validate.with.package_version, undefined);
+
+  const nightlyWorkflows = [
+    await readWorkflow('npm-publication.yml'),
+    await readWorkflow('desktop-nightly.yml'),
+  ];
+  const desktop = nightlyWorkflows[1];
+  const commands = desktop.jobs.desktop.steps
+    .map((step) => step.run)
+    .filter((run) => typeof run === 'string')
+    .join('\n');
+  assert.doesNotMatch(commands, /npm audit|audit-shipped-dependencies/u);
+
+  for (const workflow of nightlyWorkflows) {
+    const installs = Object.values(workflow.jobs)
+      .flatMap((job) => job.steps ?? [])
+      .flatMap((step) => (typeof step.run === 'string' ? step.run.split('\n') : []))
+      .filter((command) => command.trimStart().startsWith('npm ci'));
+    assert.ok(installs.length > 0);
+    for (const install of installs) assert.match(install, /--no-audit/u);
+  }
+});
+
 test('Desktop Nightly starts only from a successful published npm identity', async () => {
   const workflow = await readWorkflow('desktop-nightly.yml');
   assert.deepEqual(workflow.on, {
diff --git a/scripts/release-cli-package.mjs b/scripts/release-cli-package.mjs
index c3976e694c..da8bfc2b11 100644
--- a/scripts/release-cli-package.mjs
+++ b/scripts/release-cli-package.mjs
@@ -133,7 +133,7 @@ function main() {
     );
   }
   buildRuntimeWorkspaces({ clean: true });
-  checkProductionAudit();
+  if (!nightlyVersion) checkProductionAudit();
   runNpm(['run', 'check:cli-third-party-notices']);
   runNpm(['run', 'check:runtime-host-peer-dependencies']);
   runNpm(['run', 'check:runtime-host-peer-notices']);
@@ -220,9 +220,11 @@ function buildFromCleanDependencyTree() {
     const preparedPeerPrebuilds = copyPeerPrebuildInputToCleanTree(cleanRoot);
     console.log('[release-cli] installing the committed dependency tree with npm ci');
     const cleanEnvironment = releaseNpmEnvironment(process.env, join(cleanRoot, '.npmrc'));
+    const installArguments = ['ci'];
+    if (nightlyVersion) installArguments.push('--no-audit');
     execFileSync(
       'npm',
-      ['ci'],
+      installArguments,
       npmSpawnOptions({ cwd: cleanRoot, env: cleanEnvironment, stdio: 'inherit' }),
     );
     execFileSync(process.execPath, [join(cleanRoot, 'scripts/release-cli-package.mjs')], {


---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@maka.apache.org
For additional commands, e-mail: commits-help@maka.apache.org