build(reproducibility): pin deterministic Node and npm toolchain - #78

Closed

seonghobae wants to merge 55 commits into

mainfrom

build/deterministic-npm-toolchain

Commits on Aug 8, 2026

test(build): define deterministic npm toolchain contract
seonghobae
committed
8a10ba4
build: pin reviewed Node and npm identities
seonghobae
committed
2edd1c6
ci: fail closed on Node and npm toolchain drift
seonghobae
committed
004ca59
docs(build): define package-manager reproducibility contract
seonghobae
committed
c37b346
test(build): define lockfile change-control boundary
seonghobae
committed
59faad7
feat(build): enforce exact-base lockfile change control
seonghobae
committed
ba3d135
test(build): cover lockfile change control at 100 percent
seonghobae
committed
2acd3dc
ci: gate lockfile drift against exact PR base
seonghobae
committed
04ec5ff
test(ci): pin canonical PR base SHA validation
seonghobae
committed
8dd1b8c
fix(ci): validate pull-request base SHA canonically
seonghobae
committed
080d79f
test(ci): align canonical SHA gate assertions
seonghobae
committed
c0113f3
test(ci): accept exact Node 24 patch pins
seonghobae
committed
2a8145d
test(lockfile): cover fail-closed change-control boundaries
seonghobae
committed
8a25b4d
test(lockfile): cover fail-closed read boundaries
seonghobae
committed
65f6b1e
test(lockfile): cover malformed package maps
seonghobae
committed
5f13d64
test(ci): require exact pull-request head checkout
seonghobae
committed
443f813
fix(ci): bind verification to exact pull-request head
seonghobae
committed
bd54ad2
test(lockfile): require exact package-object binding
seonghobae
committed
879d57b
fix(lockfile): bind exact package metadata digests
seonghobae
committed
311178a
test(lockfile): cover exact digest policy and graph movement
seonghobae
committed
481ae7c
fix(lockfile): support exact-bound package graph movement
seonghobae
committed
aa0872a
test(lockfile): cover digest policy failure boundaries
seonghobae
committed
f945b64
test(lockfile): bind root-package policy to exact digests
seonghobae
committed
98d9b48
docs(lockfile): document exact digest evidence contract
seonghobae
committed
b2dd90a
test(lockfile): cover canonical array evidence
seonghobae
committed
5d88b54
refactor(lockfile): reuse exact package digests across validation
seonghobae
committed
1841f76
docs(changelog): record deterministic lockfile evidence control
seonghobae
committed
317ad2f
test(lockfile): reject duplicate JSON keys
seonghobae
committed
69fc3a0
fix(lockfile): reject ambiguous JSON evidence
seonghobae
committed
4f01943
docs(lockfile): document duplicate-key refusal
seonghobae
committed
6385232
test(ci): require Node 24 action runtimes
seonghobae
committed
b82adde
fix(ci): use Node 24 native action runtimes
seonghobae
committed
2ee7498
docs(ci): record Node 24 action provenance
seonghobae
committed
b6f4dd1
test(supply-chain): require strict install-script policy
seonghobae
committed
cad39cf
fix(supply-chain): pin reviewed install scripts
seonghobae
committed
b56601f
fix(supply-chain): fail closed on unreviewed install scripts
seonghobae
committed
54f4083
test(toolchain): require npm inert-optional fix
seonghobae
committed
aaca60d
fix(toolchain): adopt npm inert-optional fix
seonghobae
committed
c39fc58
fix(ci): pin npm inert-optional remediation release
seonghobae
committed
59d4869
docs(toolchain): justify strict install-script boundary
seonghobae
committed
fc3ea3c
test(toolchain): deny inert optional script explicitly
seonghobae
committed
c7c8859
fix(supply-chain): deny inert optional script
seonghobae
committed
feae6b8
fix(ci): bind setup-node packaged npm identity
seonghobae
committed
fdbee66
docs(toolchain): bind final Node distribution identity
seonghobae
committed
1bdfe52
docs(changelog): align deterministic toolchain evidence
seonghobae
committed
d9d42ab
test(lockfile): reject same-size read races
seonghobae
committed
d89204b
fix(lockfile): detect in-place evidence races
seonghobae
committed
15e18bc
test(lockfile): reject unenforced policy fields
seonghobae
committed
a7cc8e5
fix(lockfile): close policy schema
seonghobae
committed
f2dbd00
docs(lockfile): define closed evidence schema
seonghobae
committed
4648650
docs(changelog): record closed lockfile policy schema
seonghobae
committed
7fae0bc
test(ci): require live pull-request base verification
seonghobae
committed
3aab7af
fix(ci): bind lockfile evidence to live base tip
seonghobae
committed
8cde63a

Commits on Aug 9, 2026