From 805d47d3e33734525a93779c79001c23c5308ddc Mon Sep 17 00:00:00 2001 From: ci-bot Date: Fri, 1 May 2026 16:43:40 -0700 Subject: [PATCH] fix(lint): restrict cache lock-file glob to repo root MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `hashFiles('**/package-lock.json')` matches lock files in subdirectories (e.g. `frontend/package-lock.json`), but `actions/setup-node` looks for the lock at the repo root unless `cache-dependency-path` is set. When a repo has only a subdir lock, setup-node would set the npm cache key based on the subdir lock then fail with "Dependencies lock file is not found". Discovered while rolling out lint.yml across the fleet — broke the prettier job in ~8 repos with frontend/ subdir layouts. Restrict to root-level locks. Repos with only subdir locks now skip the cache (slower first install, but the prettier job actually runs). --- .github/workflows/lint.yml | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml index 4e808e6..dfade34 100644 --- a/.github/workflows/lint.yml +++ b/.github/workflows/lint.yml @@ -128,7 +128,12 @@ jobs: - uses: actions/setup-node@v4 with: node-version: "20" - cache: ${{ hashFiles('**/package-lock.json') != '' && 'npm' || '' }} + # `actions/setup-node` looks for the lock file at the repo root unless + # `cache-dependency-path` is provided. `**/package-lock.json` matches + # subdir lock files (e.g. `frontend/package-lock.json`) and would + # cause setup-node to fail with "Dependencies lock file is not found" + # when the root has no lock. Restrict to root files only. + cache: ${{ hashFiles('package-lock.json', 'npm-shrinkwrap.json', 'yarn.lock') != '' && 'npm' || '' }} # If the target repo has a prettier config that references plugins # (e.g. prettier-plugin-svelte), prettier needs the project's