From c680380f952ab3f0b6306c5d783d72a9cfb7106e Mon Sep 17 00:00:00 2001 From: brady gaster Date: Sat, 25 Apr 2026 13:13:10 -0700 Subject: [PATCH] fix: lockfile integrity check excludes workspace-local packages The integrity hash validation in squad-npm-publish.yml only excluded file:-prefixed resolved paths, but npm workspaces use bare relative paths (e.g. packages/squad-sdk). Changed to only check integrity for registry-resolved (https://) packages. Closes #0 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- .github/workflows/squad-npm-publish.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/squad-npm-publish.yml b/.github/workflows/squad-npm-publish.yml index bee98cf8c..779bdf4af 100644 --- a/.github/workflows/squad-npm-publish.yml +++ b/.github/workflows/squad-npm-publish.yml @@ -79,7 +79,7 @@ jobs: } const missingIntegrity = Object.keys(pkgs).filter(k => k.includes('node_modules/@bradygaster/squad-') && - pkgs[k].resolved && !pkgs[k].resolved.startsWith('file:') && + pkgs[k].resolved && pkgs[k].resolved.startsWith('https://') && (!pkgs[k].integrity || !pkgs[k].integrity.startsWith('sha512-')) ); if (missingIntegrity.length) {