[PR] fix(ci): guard stale npm script approvals [maka]

["mikemikimike (via GitHub)" <gi...@apache.org>]

mikemikimike opened a new pull request, #4381:
URL: https://github.com/apache/maka/pull/4381

   ## Summary
   
   The root `allowScripts` policy uses exact `name@version` keys, so dependency bumps can silently turn reviewed approvals into entries that match nothing. This leaves `npm ci` successful while skipping install scripts without a repository check identifying the stale policy.
   
   This change:
   
   - updates the two stale approvals to the versions present in `package-lock.json`;
   - adds an install-free `check:allow-scripts` gate that validates every approval against the lockfile, including nested packages;
   - runs the gate and its regression tests in CI.
   
   The deny-by-default policy remains unchanged; packages without an explicit approval remain denied.
   
   ## Validation
   
   - `npm ci --no-audit --no-fund`
   - `npm run check:allow-scripts`
   - `node --test --test-concurrency=1 scripts/check-allow-scripts.test.mjs`
   - `npm run build`
   - `npm run format:check`
   - `npm run lint`
   - `npm run check:asf-headers`
   - `npm run check:asf-npm`
   - `git diff --check`
   
   The repository-wide `typecheck` and `npm test` commands were also run. They report existing failures in untouched desktop, storage, CLI, evaluation, and Windows-specific PTY paths; the changed files pass their focused checks and the full build succeeds.
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@maka.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@maka.apache.org
For additional commands, e-mail: commits-help@maka.apache.org

Re: [PR] fix(ci): guard stale npm script approvals [maka]

["mikemikimike (via GitHub)" <gi...@apache.org>]

mikemikimike closed pull request #4381: fix(ci): guard stale npm script approvals
URL: https://github.com/apache/maka/pull/4381


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@maka.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@maka.apache.org
For additional commands, e-mail: commits-help@maka.apache.org