[kyle-sexton]

No related issue: test-node fails on check-wip-cap tests when resolve-config is not selected (run 39809302124)

Summary

test-node failed in run 39809302124 with Cannot find module 'yaml' from .github/actions/check-wip-cap/check-wip-cap.test.mjs:547. That line loads yaml from resolve-config's node_modules. Only the "Test resolve-config" step installs them, and that step exits early unless the plan names .github/actions/resolve-config. A change that selected check-wip-cap without resolve-config therefore ran its suite with nothing installed.

Fix

• .github/actions/check-wip-cap/package.json declares "resolve-config": "file:../resolve-config". check-wip-cap.mjs already imports ../resolve-config/resolve-config.mjs at runtime.
• scripts/run-outside-node-suites.sh runs npm ci --ignore-scripts once per run for each file: dependency that has a lockfile, before the package's npm test. On a warm cache it takes under a second, and it adds no resolve-config test run.
• The planner already turns file: dependencies into triggers (scripts/plan-test-lanes.sh:304-308), so a resolve-config change now also runs check-wip-cap's suite.
• One workflow comment is updated. Raising the job timeout was not needed.

Verification

• scripts/run-outside-node-suites.test.sh: a new fixture case (an npm stub; one locked and one unlocked file: dependency) went red first with FAIL: expected one npm ci of pkgs/locked, then npm test: test, then green with PASS=8 FAIL=0.
• Reproduced locally with resolve-config's node_modules removed. node --test in check-wip-cap failed at check-wip-cap.test.mjs:1:1. Then run-outside-node-suites.sh --paths over the run's three packages installed resolve-config first, and all three passed: check-wip-cap 39/39, maintenance-audit-lane-runs 43/43, work-unblock 117/117.
• These scripts pass: plan-test-lanes.test.sh (41/41), check-docs-only-gate.test.sh (88/88), ci-test-node-stop-commands.test.sh (2/2), and shellcheck.
• No file in the broker's BROKER_PATHS is touched.

Related

• fix(pr-pipeline): match lane PRs to queued issues by branch and serialize work-unblock admissions #9041 added the createRequire load of yaml from resolve-config.
• fix(pr-pipeline): re-fire an issue lane run cancelled before resolve-issue started #9097 and fix(pr-pipeline): treat an incomplete GitHub search as unknown #9089 are blocked by this failure.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-22T17:27:02.550561Z	8629023	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

claude-review reviewed 8629023cbc0e7c22d300971df2003e20174d3b59: 0 finding(s), 0 as inline comments.

No findings. I read the full diff and PR context, and I read scripts/run-outside-node-suites.sh and the file: trigger logic at scripts/plan-test-lanes.sh:295-315. I did not run the test suites; the green results in the PR description are the author's claims, not something I checked.

• install_locked_deps: the while loop is fed by process substitution, so the installed[...] dedup survives the loop. installed is declared before any call. A file: dependency without a lockfile is skipped.
• file: dependency parsing: it uses the same jq expression the planner uses to turn file: dependencies into triggers, so the two stay consistent.
• .github/actions/check-wip-cap/package.json: adding the file: dependency creates no lockfile mismatch, because check-wip-cap has no lockfile. resolve-config does have a package-lock.json, which is what npm ci needs.
• Added test case: it matches the code path. It uses an npm stub and checks that exactly one npm ci runs for the locked dependency, then npm test.
• Workflow comment change: it matches the new behavior.
• Manifests: the diff touches no plugin manifests, so there are no manifest lines to report.
• Closing issue: the PR states "No related issue", so there are no acceptance criteria to check.

[github-actions]

claude-security-review reviewed 8629023cbc0e7c22d300971df2003e20174d3b59: 0 finding(s), 0 as inline comments.

No security findings on head 8629023.

The PR has four changes:

• It adds a file:../resolve-config dependency to .github/actions/check-wip-cap/package.json.

• It adds install_locked_deps to scripts/run-outside-node-suites.sh.

• It adds a test for that function.

• It edits a comment in pr-require-checks.yml.

• Install behaviour: the new function runs npm ci --ignore-scripts --prefix <dir> only for file: dependencies that have a package-lock.json. Lifecycle scripts are disabled and the lockfile fixes the resolved versions. The only new install source is the in-repo resolve-config, which has a lockfile.

• Path handling: the dependency path comes from a package.json in the PR itself. The same script already runs that package's npm test, which is PR-controlled code, so a crafted file: path gives no new capability. The shell expansions are quoted, and jq reads the manifest as data.

• Workflow: the pr-require-checks.yml change is a comment only. It adds no triggers, permissions, expressions or action pins.

• Plugin manifests: no .claude-plugin/plugin.json or marketplace.json was changed, so there are no manifest <field> lines.

• Instruction surfaces: no standing instruction was deleted or softened.