[codex] Fix post-merge health checks

.github/workflows/release.yml

@@ -28,8 +28,11 @@ jobs:
           cache: pnpm
           registry-url: https://registry.npmjs.org
 
-      - name: Upgrade npm to 11.5.1+ (required for trusted publishing OIDC)
-        run: npm install -g npm@latest
+      - name: Install npm 11.14.1 for trusted publishing OIDC
+        run: |
+          npm_config_prefix="$RUNNER_TEMP/npm" npm install --global npm@11.14.1
+          echo "$RUNNER_TEMP/npm/bin" >> "$GITHUB_PATH"
+          "$RUNNER_TEMP/npm/bin/npm" --version
 
       - run: pnpm install --frozen-lockfile
       - run: pnpm typecheck

.github/workflows/scorecard.yml

@@ -8,16 +8,17 @@ on:
     - cron: "41 10 * * 1"
   workflow_dispatch:
 
-permissions:
-  contents: read
-  id-token: write
-  security-events: write
+permissions: read-all
 
 jobs:
   scorecard:
     name: Scorecard
     runs-on: ubuntu-latest
     timeout-minutes: 20
+    permissions:
+      contents: read
+      id-token: write
+      security-events: write
     steps:
       - uses: ossf/scorecard-action@v2.4.3
         with:

apps/website/e2e/smoke.spec.ts

@@ -35,8 +35,8 @@ test("docs brand link returns to drawer when it was last open", async ({
 
   // Navigate to /docs via the in-drawer /docs link.
   await page
-    .getByRole("link", { name: /\/docs/i })
-    .first()
+    .getByTestId("drawer-shell")
+    .getByRole("link", { name: "/docs", exact: true })
     .click();
   await expect(page).toHaveURL(/\/docs/);