Merge pull request #7 from allocsys/ci-lockfile-cache-yamllint

CI: use lockfile-based npm cache + npm ci, lint render.yaml

Author: allocsys

.github/workflows/ci.yml

@@ -15,22 +15,15 @@ jobs:
       - uses: actions/setup-node@v4
         with:
           node-version: "20"
+          cache: npm
 
-      # Manual cache keyed on package.json, since no package-lock.json is
-      # committed yet -- setup-node's built-in `cache: npm` requires a
-      # lockfile to hash against. Once generate-lockfile.yml (workflow_dispatch)
-      # has run and committed one, switch this to `cache: npm` on setup-node
-      # (keyed on package-lock.json) + `npm ci` instead of `npm install`.
-      - name: Cache npm dependencies
-        uses: actions/cache@v4
-        with:
-          path: ~/.npm
-          key: ${{ runner.os }}-npm-${{ hashFiles('package.json') }}
-          restore-keys: |
-            ${{ runner.os }}-npm-
+      - name: Lint render.yaml
+        run: |
+          set -e
+          npx --yes yaml-lint render.yaml
 
       - name: Install dependencies
-        run: npm install
+        run: npm ci
 
       - name: Syntax-check all source files
         run: |

.github/workflows/generate-lockfile.yml

@@ -1,10 +1,9 @@
 name: Generate lockfile
 
-# Manual maintenance workflow: this session's sandbox has no network access,
-# so it can't run `npm install` to produce a real package-lock.json. GitHub
-# Actions does have network access, so run this once (and again any time
-# dependencies change) to generate and commit one -- then switch ci.yml over
-# to setup-node's built-in `cache: npm` (keyed on the lockfile) + `npm ci`.
+# Manual maintenance workflow: run this any time package.json's dependencies
+# change, to regenerate and commit package-lock.json. ci.yml already relies
+# on this lockfile (setup-node's `cache: npm` + `npm ci`), so a stale
+# lockfile will fail CI with a clear npm-ci mismatch error until this is run.
 on:
   workflow_dispatch: {}