From d7387dced8f2b1e0b934cc563597e5d5962c3f3b Mon Sep 17 00:00:00 2001
From: Brian Love <brian@liveloveapp.com>
Date: Fri, 8 May 2026 12:11:12 -0700
Subject: [PATCH] ci: fix post-merge health checks

---
 .github/workflows/release.yml   | 7 +++++--
 .github/workflows/scorecard.yml | 9 +++++----
 apps/website/e2e/smoke.spec.ts  | 4 ++--
 3 files changed, 12 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index f637e28cf..9a765f6bc 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -28,8 +28,11 @@ jobs:
           cache: pnpm
           registry-url: https://registry.npmjs.org
 
-      - name: Upgrade npm to 11.5.1+ (required for trusted publishing OIDC)
-        run: npm install -g npm@latest
+      - name: Install npm 11.14.1 for trusted publishing OIDC
+        run: |
+          npm_config_prefix="$RUNNER_TEMP/npm" npm install --global npm@11.14.1
+          echo "$RUNNER_TEMP/npm/bin" >> "$GITHUB_PATH"
+          "$RUNNER_TEMP/npm/bin/npm" --version
 
       - run: pnpm install --frozen-lockfile
       - run: pnpm typecheck
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index cf12f37bb..b1bdb9c5d 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -8,16 +8,17 @@ on:
     - cron: "41 10 * * 1"
   workflow_dispatch:
 
-permissions:
-  contents: read
-  id-token: write
-  security-events: write
+permissions: read-all
 
 jobs:
   scorecard:
     name: Scorecard
     runs-on: ubuntu-latest
     timeout-minutes: 20
+    permissions:
+      contents: read
+      id-token: write
+      security-events: write
     steps:
       - uses: ossf/scorecard-action@v2.4.3
         with:
diff --git a/apps/website/e2e/smoke.spec.ts b/apps/website/e2e/smoke.spec.ts
index 40df1912a..6e7fcb252 100644
--- a/apps/website/e2e/smoke.spec.ts
+++ b/apps/website/e2e/smoke.spec.ts
@@ -35,8 +35,8 @@ test("docs brand link returns to drawer when it was last open", async ({
 
   // Navigate to /docs via the in-drawer /docs link.
   await page
-    .getByRole("link", { name: /\/docs/i })
-    .first()
+    .getByTestId("drawer-shell")
+    .getByRole("link", { name: "/docs", exact: true })
     .click();
   await expect(page).toHaveURL(/\/docs/);