chore: use frozen lockfile for CI dependency installs

[cb-jit-bhuin]

CHANGELOG

chore: use frozen lockfile for CI dependency installs

SUMMARY

Closes the 2 supply-chain security findings raised against this repo (deadline: August 9, 2026).

Both findings are bare yarn install steps in GitHub Actions, which resolve dependencies fresh instead of installing exactly what the committed lockfile specifies:

• .github/workflows/build.yml
• .github/workflows/release.yml

Both are now yarn install --frozen-lockfile. The repo pins "packageManager": "yarn@1.22.19", so this is the deterministic equivalent for yarn v1 — it fails the build rather than silently rewriting the lockfile if yarn.lock has drifted from package.json.

No lockfile needed to be added: yarn.lock is already committed and tracked.

Also included: cache key fix

Both workflows keyed the node_modules cache off hashFiles('**/package-lock.json') while installing with yarn. Since the install step is guarded by if: steps.cache-nodemodules.outputs.cache-hit != 'true', and the stale package-lock.json never changes, dependency updates did not invalidate the cache and the install step was being skipped entirely — builds ran against whatever node_modules was cached earlier. Both keys now hash yarn.lock, so --frozen-lockfile actually runs when dependencies change.

Also included: actions/cache@v2 → v4 in build.yml

The build check has been failing on every PR since at least June 2026 (including Snyk's automated ones), and it was failing on this PR too. The cause is unrelated to the changes above:

This request has been automatically failed because it uses a deprecated version of actions/cache: v2.

The job aborted during setup, before reaching the install step. release.yml was already on actions/cache@v4; only build.yml was left behind. Bumping it was necessary to get any verification of the frozen-lockfile change at all.

FUNCTIONAL AUTOMATION CHANGES PR

• Yes
  • If Yes, PR :
• No
  • If No, Reason: CI configuration only; no SDK source or behaviour changes.

AUTOMATION TEST REPORT URL

NA — the existing lint and test steps in build.yml are the verification.

AREAS OF IMPACT

CI only (.github/workflows/build.yml, .github/workflows/release.yml). No changes to published package contents or runtime behaviour.

TYPE OF CHANGE

• 🐞 Bugfix
• 🌟 Feature
• ✨ Enhancement
• 🧪 Unit Test Cases
• 📔 Documentation
• ⚙️ Chore - Build Related / Configuration / Others

DOCUMENTATION

Supply-chain security initiative announcement in #team-engineering. Questions to #ask-security.

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues
✅	Secrets	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Enterprise

Run ID: caa11dc8-9b74-4518-a7ce-f8c19da92761

📥 Commits

Reviewing files that changed from the base of the PR and between 39097bb and 1a9177e.

📒 Files selected for processing (1)

• .github/workflows/build.yml

🚧 Files skipped from review as they are similar to previous changes (1)

• .github/workflows/build.yml

---

Walkthrough

The build and release workflows now use yarn.lock for dependency cache keys. Both workflows enforce locked installation with yarn install --frozen-lockfile. The build workflow uses actions/cache@v4.

Changes

CI dependency lockfile handling

Layer / File(s)	Summary
Align workflow caching and installation .github/workflows/build.yml, .github/workflows/release.yml	Both workflows hash yarn.lock and use yarn install --frozen-lockfile. The build workflow updates actions/cache to v4. Restore-key behavior remains unchanged.

Estimated code review effort: 1 (Trivial) | ~3 minutes

🚥 Pre-merge checks | ✅ 1

✅ Passed checks (1 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

---

_{Comment @coderabbitai help to get the list of available commands.}

[cb-jit-bhuin]

https://mychargebee.atlassian.net/browse/OMNISUB-7617 Source JIRA