[mldangelo-oai]

Summary

The npm and GitHub release jobs installed the same npm version from the same registry, then checked the runner's PATH differently. Both jobs now require the executable they just installed before continuing. This also removes the second copy of the installer and the extra Node process that parsed the version in the npm release job.

Changes

• Share the isolated install of npm 11.12.1 through the Socket Firewall. Each job still writes the installed directory to GITHUB_PATH and verifies the selected executable in a separate step.
• Check the helper with ShellCheck and replace the workflow text assertions with a test that exercises both callers' actual shell. Each verification runs in a new process. Both a wrong version at the correct path and a second executable reporting 11.12.1 must fail.
• Remove 22 net lines from the workflows and helper, and three net lines overall.

Testing

• Ran the SDK release automation, Action release, and container release suites: 380 tests passed. SDK and MCP type checks, formatting, actionlint, ShellCheck, zizmor, and all 16 CI selection tests passed.
• Exercised both jobs with a mock npm installer: correct selection, incorrect or missing installs, failed installation, missing PATH handoff, and alternate executables. The checked-in test failed when either comparison was removed or when both verification steps stopped loading the helper. Restoring each change made it pass. No registry publish or release was run.

Risk and rollout

The release jobs keep the same Node version, npm pin, registry, permissions, and provenance checks. If the runner selects a different npm after setup, the job now stops before any release command. Normal release timing is expected to be similar.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-25T19:34:54.411014Z	1a1cba5	New commits
🔒 Security Review	✅ Completed 2026-10-25T19:36:24.188451Z	1a1cba5	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[alandelong-oai]

Thanks for sharing the release npm setup and testing the actual workflow shell. This owner-level merge-safety review found no material issues. Both jobs now intentionally require npm 11.12.1 at the installed path in a fresh step before release operations; the helper is loaded from the matching trusted checkout and preserves the isolated install and provenance checks.

Validation passed: 380 release tests, 22 additional mock install/PATH cases, 16 CI-selection tests, the CI build, SDK/MCP typechecks, configured formatting, actionlint/ShellCheck, and configured zizmor. The mock cases include failed or missing installs, missing PATH handoff, wrong versions, and another executable reporting the correct version. No live registry install, publication, or release workflow was exercised.