Repository navigation
[AW Top 10] 10 Emit deterministic installs in compiled workflows #67455
Description
Priority 10/10 | 1 source issues | Impact 4/5 | Confidence 4/5 | Effort 4/5
One assignment, one coherent fix
Compiled lock files run npm and pip installs without lockfiles or hashes, raising hundreds of alerts.
Implementation scope
Change the compiler to emit npm ci with a lockfile and hash-pinned uv pip installs, then recompile all workflows.
Done when
- Compiled lock files contain no unpinned npm or pip installs.
- Open code-scanning alerts for these rules drop to zero.
Why now
There are 259 alerts from one generator, so one compiler change addresses them. Changing every lock file needs review.
AW source issues and corroborating reports
No corroborating AW discussion; evidence comes from the source issues.
Unchanged AW sources close only after this summary is completed. Newer source activity and not-planned retirement do not trigger source closure. Assigned summaries are frozen; unassign to allow reclustering.
Generated by AW Essential Issue Clustering · copilot · auto · 40.1 AIC · ⌖ 0.589 AIC · ⊞ 8.9K · ◷
Activity