Skip to content

CLOUDPLAT-3162: disable run-tests in npm-release workflow#171

Merged
haseebehsan merged 1 commit into
masterfrom
cloudplat-3162/fix-npm-release-tests
Jun 22, 2026
Merged

CLOUDPLAT-3162: disable run-tests in npm-release workflow#171
haseebehsan merged 1 commit into
masterfrom
cloudplat-3162/fix-npm-release-tests

Conversation

@haseebehsan

Copy link
Copy Markdown
Contributor

Summary

The npm-release.yml workflow was failing because test/shortcuts.test.js calls cfn-lint (a Python tool) which isn't installed in the reusable workflow's runner. The existing test.yml CI workflow handles this by installing Python and cfn-lint via requirements.dev.txt before running tests.

Since tests are already enforced on every PR merge via test.yml, there's no need to re-run them at publish time. Adding run-tests: false skips the test step in the publish workflow.

Ticket: https://mapbox.atlassian.net/browse/CLOUDPLAT-3162

Tests require cfn-lint (Python) which is not available in the
reusable workflow runner. Tests are already enforced on every PR
via the separate test.yml workflow.

https://mapbox.atlassian.net/browse/CLOUDPLAT-3162
@haseebehsan haseebehsan requested a review from a team as a code owner June 22, 2026 08:21
@haseebehsan haseebehsan added the ai AI coding agents co-authored the code label Jun 22, 2026
@ox-security

ox-security Bot commented Jun 22, 2026

Copy link
Copy Markdown

OX Security Logo

Successfully scanned changes introduced in a pull request into master from cloudplat-3162/fix-npm-release-tests.

Internal scan identifier: 6d7e8cef-48db-4f51-b4d5-dd9c9f93c869.

Total issues Blocking issues Scan status
1 0 ✔️
Category Issues
CI/CD Posture 1

See all issues found during this scan in the OX Security Application.

Detailed information
Issue #1
NameUnpinned Reusable Workflow • GitHub Actions
StatusNew
EnforcementMonitor
SeverityHigh
CategoryCI/CD Posture
Source toolsOX CI/CD Posture
RecommendationPin reusable workflows to a full-length commit SHA (40 characters) instead of a tag or branch. Example: uses: org/repo/.github/workflows/build.yml@a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0
1 aggregation
FileMatch
.github/workflows/npm-release.ymluses: mapbox/gha-public/.github/workflows/workflow-npm-oidc-publish.yml@main

@haseebehsan haseebehsan merged commit 05ea160 into master Jun 22, 2026
7 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

ai AI coding agents co-authored the code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants