Skip to content

Use npm ci in issue automation workflows - #14702

Merged
Sean McManus (sean-mcmanus) merged 1 commit into
mainfrom
seanmcm/devbox2-wsl/agent16/use-npm-ci-issue-actions
Aug 25, 2026
Merged

Use npm ci in issue automation workflows#14702
Sean McManus (sean-mcmanus) merged 1 commit into
mainfrom
seanmcm/devbox2-wsl/agent16/use-npm-ci-issue-actions

Conversation

@sean-mcmanus

@sean-mcmanus Sean McManus (sean-mcmanus) commented Aug 24, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Summary

Use npm ci --omit=dev in the 19 scheduled issue-automation workflows so their production dependencies are installed exactly from .github/actions/package-lock.json.

Why this helps

These workflows run on a schedule and automatically label, comment on, close, reopen, or lock issues. Their behavior depends on the JavaScript packages installed before each run, so the install should be repeatable for a given repository commit.

npm install --production can reconcile differences between package.json and package-lock.json while the workflow is running. That makes an accidental mismatch less obvious and can cause the workflow to run with a dependency graph other than the one recorded in the committed lockfile.

npm ci --omit=dev instead:

  • requires package.json and package-lock.json to agree, failing the job when they do not;
  • installs the production dependency versions recorded in the lockfile;
  • starts from a clean node_modules directory; and
  • leaves the package manifest and lockfile unchanged.

This makes repeated scheduled runs from the same commit more predictable and turns dependency drift into a visible failure instead of silently changing what the automation runs. That is especially useful for workflows that act on user-facing issues without someone manually reviewing every scheduled execution.

This carries forward the supported deterministic dependency-restoration portion of #14701.

This PR was investigated and created by GitHub Copilot in VS Code. Any message starting with ✨Copilot: was sent by Copilot.

Validation

  • Ran npm ci --omit=dev from a clean .github/actions directory with Node 24.18.1 and npm 11.16.0.
  • Confirmed the install resolved the complete production graph and left package-lock.json byte-identical.
  • Confirmed npm ci --omit=dev rejects a temporary package.json/package-lock.json mismatch.
  • Syntax-checked all four action entry points with Node 24.
  • Confirmed YAML diagnostics and git diff --check are clean.

@github-project-automation github-project-automation Bot moved this to Pull Request in cpptools Aug 24, 2026
@sean-mcmanus
Sean McManus (sean-mcmanus) requested a balanced review from Copilot August 24, 2026 23:39
Copilot AI reviewed Aug 24, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Updates scheduled issue-automation workflows to restore production dependencies deterministically from .github/actions/package-lock.json.

Changes:

  • Replaces npm install --production with npm ci --omit=dev.
  • Applies the change consistently across all 19 workflows.

Reviewed changes

Copilot reviewed 19 out of 19 changed files in this pull request and generated no comments.

Show a summary per file
File Description
.github/workflows/question-closer.yml Uses locked production dependencies.
.github/workflows/question-closer-debugger.yml Uses locked production dependencies.
.github/workflows/more-info-needed-closer.yml Uses locked production dependencies.
.github/workflows/more-info-needed-closer-debugger.yml Uses locked production dependencies.
.github/workflows/locker.yml Uses locked production dependencies.
.github/workflows/investigate-costing-closer-debugger.yml Uses locked production dependencies.
.github/workflows/investigate-closer-debugger.yml Uses locked production dependencies.
.github/workflows/feature-request-reopener.yml Uses locked production dependencies.
.github/workflows/feature-request-debugger.yml Uses locked production dependencies.
.github/workflows/feature-request-closer-triage.yml Uses locked production dependencies.
.github/workflows/feature-request-closer-no-milestone.yml Uses locked production dependencies.
.github/workflows/external-closer-debugger.yml Uses locked production dependencies.
.github/workflows/enhancement-reopener.yml Uses locked production dependencies.
.github/workflows/enhancement-closer-triage.yml Uses locked production dependencies.
.github/workflows/enhancement-closer-no-milestone.yml Uses locked production dependencies.
.github/workflows/duplicate-closer.yml Uses locked production dependencies.
.github/workflows/by-design-closer.yml Uses locked production dependencies.
.github/workflows/by-design-closer-debugger.yml Uses locked production dependencies.
.github/workflows/bug-debugger.yml Uses locked production dependencies.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

@sean-mcmanus
Sean McManus (sean-mcmanus) marked this pull request as ready for review August 25, 2026 01:19
@sean-mcmanus
Sean McManus (sean-mcmanus) requested a review from a team as a code owner August 25, 2026 01:19
@sean-mcmanus
Sean McManus (sean-mcmanus) merged commit 1906a6a into main Aug 25, 2026
7 checks passed
@sean-mcmanus
Sean McManus (sean-mcmanus) deleted the seanmcm/devbox2-wsl/agent16/use-npm-ci-issue-actions branch August 25, 2026 02:48
@github-project-automation github-project-automation Bot moved this from Pull Request to Done in cpptools Aug 25, 2026
Sean McManus (sean-mcmanus) added a commit that referenced this pull request Sep 9, 2026
@sean-mcmanus @bobbrow
@Colengms @dependabot @8prashant @afreof Adrian Freihofer @csigs
Merge main into vs (#14754)
e57eef8 
* Use npm ci in issue workflows (#14702)

* Pin the Yarn bootstrap and add SHA-512 lock checksums (#14703)

* Add SHA-512 checksums to yarn.lock

* Pin the Yarn bootstrap install

* Register LLVM component for LLDB-MI (#14704)

* Add xobjgen to gitignore (for Linux/Mac). (#14707)

* Retry transient Yarn install failures (#14708)

* Ensure the language client is always ready before using it (#14617)

* Update 1.34.0 changelog (#14710)

* Update changelog and version for 1.34.1 (#14714)

* Update clang-tidy checks to 23.1.0 (#14713)

* Use native file type mappings for TypeScript-side classification (#14711)

* Add 1.34.2 changelog (#14722)

* Add 1.34.2 changelog

* Remove ignored network isolation policy (#14728)

* Bump fast-uri from 3.1.5 to 3.1.6 in /ExtensionPack (#14731)

Bumps [fast-uri](https://github.com/fastify/fast-uri) from 3.1.5 to 3.1.6.
- [Release notes](https://github.com/fastify/fast-uri/releases)
- [Commits](fastify/fast-uri@v3.1.5...v3.1.6)

---
updated-dependencies:
- dependency-name: fast-uri
  dependency-version: 3.1.6
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Bump @xmldom/xmldom from 0.8.13 to 0.8.15 in /Extension (#14733)

Bumps [@xmldom/xmldom](https://github.com/xmldom/xmldom) from 0.8.13 to 0.8.15.
- [Release notes](https://github.com/xmldom/xmldom/releases)
- [Changelog](https://github.com/xmldom/xmldom/blob/master/CHANGELOG.md)
- [Commits](xmldom/xmldom@0.8.13...0.8.15)

---
updated-dependencies:
- dependency-name: "@xmldom/xmldom"
  dependency-version: 0.8.15
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Bump browserslist from 4.28.1 to 4.28.8 in /Extension (#14732)

Bumps [browserslist](https://github.com/browserslist/browserslist) from 4.28.1 to 4.28.8.
- [Release notes](https://github.com/browserslist/browserslist/releases)
- [Changelog](https://github.com/browserslist/browserslist/blob/main/CHANGELOG.md)
- [Commits](browserslist/browserslist@4.28.1...4.28.8)

---
updated-dependencies:
- dependency-name: browserslist
  dependency-version: 4.28.8
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Remove unused gulp-sourcemaps dependency (#14729)

* Remove unused gulp-sourcemaps dependency

* Remove orphaned dependency resolutions

* Fix custom configuration provider regression (#14725)

* Restore custom configuration provider checks

* Ignore empty crash report files (#14730)

* Ignore empty crash report files

* Preserve pending crash reads across clients

* Keep crash writing state for pending reports

* Fix fast-uri dependency. (#14735)

* Fix fast-uri dependency.

* Also for Themes.

* Implement session state tracking for "Run and Debug" button when Inte… (#14719)

* Implement session state tracking for "Run and Debug" button when IntelliSense is disabled and add corresponding tests

* Enhance session state tracking for build and debug by updating folder open status and adding tests

* Fix build and debug folder session state tracking

* Potential fix for pull request finding

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

* Potential fix for pull request finding

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Sean McManus <seanmcm@microsoft.com>

* Fix #11263: Make Edit Configurations UI fully theme-aware in custom themes (#14692)

* Fix #11263: use theme-aware colors in Edit Configurations UI

* Enhance dropdown styling with theme-aware colors in settings UI

---------

Co-authored-by: Sean McManus <seanmcm@microsoft.com>

* Add processFilter for remote attach process selection (#14684)

* Add processFilter for remote attach process selection

When attaching to a process on a remote target, the process always has
to be selected by hand, even though the launch configuration already
knows which executable it belongs to. A generated configuration cannot
hard-code processId either, because the pid changes on every boot and
on every restart of the service, so the picker is the only option.

Add an optional processFilter regular expression to the cppdbg attach
configuration. When set, it is matched against the label, description
and detail of the remote process list:

  exactly one match  attach to that process directly
  more than one      show the picker with only the matching entries
  no match           show the full picker, as before

All three fields are considered because the item format depends on the
transport: useExtendedRemote reports the user and the full command line
in the label, while pipeTransport reports the process name in the label
and the command line in the detail.

An invalid regular expression is reported instead of being silently
ignored.

This affects remote attach only (pipeTransport and useExtendedRemote);
local attach continues to use program-based matching.

Closes #14682

* Extract remote process filtering into a helper

Move the matching logic out of RemoteAttachPicker into a standalone
function so that it can be unit tested without a VS Code quick pick or
a live connection to a remote target.

No functional change.

* Add unit tests for processFilter matching

Cover empty and non-string filter values, matching against label,
description and detail, multiple matches, an invalid regular
expression, and a regression case ensuring missing fields are not
treated as empty strings.

---------

Co-authored-by: Adrian Freihofer <adrian.freihofer@siemens.com>
Co-authored-by: Sean McManus <seanmcm@microsoft.com>

* Bump the github-actions group with 2 updates (#14738)

Bumps the github-actions group with 2 updates: [github/codeql-action/init](https://github.com/github/codeql-action) and [github/codeql-action/analyze](https://github.com/github/codeql-action).


Updates `github/codeql-action/init` from 4.37.7 to 4.37.9
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@ff2f1c6...cdf488f)

Updates `github/codeql-action/analyze` from 4.37.7 to 4.37.9
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@ff2f1c6...cdf488f)

---
updated-dependencies:
- dependency-name: github/codeql-action/init
  dependency-version: 4.37.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: github/codeql-action/analyze
  dependency-version: 4.37.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Fix localization translation errors (#14737)

* Localization - Translated Strings

* Fix localization translation errors

* Address localization review feedback

* Fix localization review feedback

---------

Co-authored-by: csigs <csigs@users.noreply.github.com>

* Update changelog for 1.34.3 (#14740)

* Update changelog and version for 1.34.4. (#14748)

* Enable PR CI for release and insiders (#14751)

* Fix localization string import (#14743)

* Fix localization string import
* Correct conversion cycle translations

* Add Run and Debug session state tests (#14736)

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: Bob Brown <bobbrow@users.noreply.github.com>
Co-authored-by: Colen Garoutte-Carson <49173979+Colengms@users.noreply.github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Prashant Kumar Rai <prashant.kumar2021@vitbhopal.ac.in>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: afreof <adrian.freihofer@gmail.com>
Co-authored-by: Adrian Freihofer <adrian.freihofer@siemens.com>
Co-authored-by: csigs <csigs@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot
Copilot review effort, defaults to Balanced
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments
@Colengms Colen Garoutte-Carson (Colengms) Colengms approved these changes

Assignees

No one assigned

Labels

None yet

Projects

cpptools
Status: Done

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@sean-mcmanus @Colengms