fix CI validation dependency ordering

Author: tensornull

.github/workflows/ci.yml

@@ -30,6 +30,9 @@ jobs:
         uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
         with:
           node-version: 24.x
+          cache: npm
+      - name: Install locked dependencies
+        run: npm ci
       - name: Validate Public Preview content and identity
         run: npm run check:public-preview
       - name: Download the pinned actionlint release

.github/workflows/publish.yml

@@ -80,6 +80,13 @@ jobs:
           EOF
 
           echo "release-commit=${release_commit}" >> "$GITHUB_OUTPUT"
+      - name: Set up Node.js 24
+        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
+        with:
+          node-version: 24.x
+          cache: npm
+      - name: Install validation dependencies without lifecycle scripts
+        run: npm ci --ignore-scripts
       - name: Verify release metadata and derive the npm dist-tag
         id: version
         env:
@@ -93,11 +100,6 @@ jobs:
             --release-prerelease "$RELEASE_IS_PRERELEASE" \
             --require-final \
             --require-releasable-docs >> "$GITHUB_OUTPUT"
-      - name: Set up Node.js 24
-        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
-        with:
-          node-version: 24.x
-          cache: npm
       - name: Use a Trusted Publishing-capable npm CLI
         run: npm install --global npm@11.12.1
       - name: Install locked dependencies

tests/ci-workflow.test.mjs

@@ -4,9 +4,9 @@ import { URL } from "node:url";
 import { describe, expect, it } from "vitest";
 import { parseDocument } from "yaml";
 
-function readWorkflow() {
+function readWorkflow(name = "ci.yml") {
   const source = readFileSync(
-    new URL("../.github/workflows/ci.yml", import.meta.url),
+    new URL(`../.github/workflows/${name}`, import.meta.url),
     "utf8",
   );
   const document = parseDocument(source, { uniqueKeys: true });
@@ -15,6 +15,84 @@ function readWorkflow() {
 }
 
 describe("blocking CI workflow", () => {
+  it("installs dependencies before dependency-backed workflow gates", () => {
+    const workflowLint = readWorkflow().jobs?.["workflow-lint"];
+    expect(workflowLint).toBeDefined();
+    const previewInstall = workflowLint.steps.findIndex(
+      (step) => step.run === "npm ci",
+    );
+    const previewGate = workflowLint.steps.findIndex(
+      (step) => step.run === "npm run check:public-preview",
+    );
+    expect(workflowLint.steps[previewInstall]).toEqual({
+      name: "Install locked dependencies",
+      run: "npm ci",
+    });
+    expect(workflowLint.steps[previewGate]).toEqual({
+      name: "Validate Public Preview content and identity",
+      run: "npm run check:public-preview",
+    });
+    expect(previewGate).toBeGreaterThan(previewInstall);
+
+    const releaseVerify = readWorkflow("publish.yml").jobs?.verify;
+    expect(releaseVerify).toBeDefined();
+    const trustGate = releaseVerify.steps.findIndex(
+      (step) => step.id === "trust",
+    );
+    const validationInstall = releaseVerify.steps.findIndex(
+      (step) => step.run === "npm ci --ignore-scripts",
+    );
+    const releaseGate = releaseVerify.steps.findIndex(
+      (step) =>
+        typeof step.run === "string" &&
+        step.run.includes("node scripts/validate-release.mjs"),
+    );
+    const fullInstall = releaseVerify.steps.findIndex(
+      (step, index) => index > releaseGate && step.run === "npm ci",
+    );
+    expect(Object.keys(releaseVerify.steps[trustGate]).sort()).toEqual([
+      "env",
+      "id",
+      "name",
+      "run",
+      "shell",
+    ]);
+    expect(releaseVerify.steps[trustGate]).toMatchObject({
+      id: "trust",
+      name: "Reject an untrusted release target",
+      shell: "bash",
+    });
+    expect(releaseVerify.steps[validationInstall]).toEqual({
+      name: "Install validation dependencies without lifecycle scripts",
+      run: "npm ci --ignore-scripts",
+    });
+    expect(validationInstall).toBeGreaterThan(trustGate);
+    expect(releaseVerify.steps[releaseGate]).toEqual({
+      env: {
+        RELEASE_IS_PRERELEASE: "${{ github.event.release.prerelease }}",
+        RELEASE_TAG: "${{ github.event.release.tag_name }}",
+      },
+      id: "version",
+      name: "Verify release metadata and derive the npm dist-tag",
+      run: [
+        "set -euo pipefail",
+        "node scripts/validate-release.mjs \\",
+        '  --tag "$RELEASE_TAG" \\',
+        '  --release-prerelease "$RELEASE_IS_PRERELEASE" \\',
+        "  --require-final \\",
+        '  --require-releasable-docs >> "$GITHUB_OUTPUT"',
+        "",
+      ].join("\n"),
+      shell: "bash",
+    });
+    expect(releaseGate).toBeGreaterThan(validationInstall);
+    expect(releaseVerify.steps[fullInstall]).toEqual({
+      name: "Install locked dependencies",
+      run: "npm ci",
+    });
+    expect(fullInstall).toBeGreaterThan(releaseGate);
+  });
+
   it("runs the live-smoke contract in the locked Node.js 22 and 24 job", () => {
     const workflow = readWorkflow();
     const locked = workflow.jobs?.locked;