From 946c34b223dff01a4b419b33d0ec7c4199bc649c Mon Sep 17 00:00:00 2001 From: Courier Date: Tue, 13 Oct 2026 05:48:15 +0000 Subject: [PATCH] ci: remove redundant npm ci step from Security Audit workflow (#1174) The ./.github/actions/setup-node composite action already runs `npm ci --include=dev`, and .npmrc sets include=dev, so the bare `npm ci` reinstalled an identical tree and doubled the job's slowest step. The job still runs the blocking `npm run audit` gate followed by the non-blocking dev-inclusive pass. --- .github/workflows/security-audit.yaml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.github/workflows/security-audit.yaml b/.github/workflows/security-audit.yaml index 026a74db..c40a571f 100644 --- a/.github/workflows/security-audit.yaml +++ b/.github/workflows/security-audit.yaml @@ -12,8 +12,9 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + # The composite action already runs `npm ci --include=dev`; a second + # bare `npm ci` reinstalled the same tree (#1174). - uses: ./.github/actions/setup-node - - run: npm ci # Blocking gate: production + optional dependencies only (#1166). The # .npmrc include=dev would otherwise cancel --omit=dev, so the script # passes an explicit --include=prod; see the "//".audit note in package.json.