[rishigupta1599]

Why

PER-8766 (security finding F-009, hardening): release.yml ran a bare yarn before npm publish. If yarn.lock drifts from package.json, yarn v1 quietly re-resolves and installs versions that were never reviewed or tested, and they ship in the published @percy/playwright tarball.

What

• release.yml, lint.yml, typecheck.yml, and the top-level install in test.yml: yarn changed to yarn install --frozen-lockfile. A lockfile/manifest mismatch now fails CI instead of resolving silently.
• The workflow_dispatch percy/cli-branch block in test.yml is unchanged, because it installs a separate checkout. The deprecated set-output lines are also unchanged; they are a separate concern.

Verification

• On master, yarn install --frozen-lockfile --ignore-scripts (yarn 1.22.22) succeeds on node:18 and node:20: 342 packages, exit 0, and yarn.lock stays byte-identical. The committed lockfile is already in sync, so no lockfile change is needed.
• The CI checks on this PR run the new install step.

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores
  • Updated automated validation and release processes to install dependencies using the locked dependency versions.
  • Improves consistency and reproducibility across linting, testing, type checks, and publishing.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Central YAML (base), Organization UI (inherited), Workspace UI (inherited)
• Review profile: ASSERTIVE
• Plan: Enterprise
• Run ID: dd15830a-3921-4c4b-a4d8-bc40de2f1205

📥 Commits

Reviewing files that changed from the base of the PR and between 3bead3f and 964c628.

📒 Files selected for processing: 4

• .github/workflows/lint.yml
• .github/workflows/release.yml
• .github/workflows/test.yml
• .github/workflows/typecheck.yml

Included review availability: This review used your included allowance. Your plan provides up to 12 included reviews per hour; 8 remain after this review.

📜 Recent review details

⏰ Context from checks skipped due to timeout: 7

• GitHub Check: semgrep/ci
• GitHub Check: Analyze (actions)
• GitHub Check: Analyze (javascript-typescript)
• GitHub Check: Lint
• GitHub Check: Test (ubuntu-latest, 22)
• GitHub Check: Typecheck
• GitHub Check: Test (ubuntu-latest, 20)

🔇 Additional comments: 4

.github/workflows/lint.yml: 1

23-23: LGTM!

.github/workflows/test.yml: 1

43-43: LGTM!

.github/workflows/typecheck.yml: 1

23-23: LGTM!

.github/workflows/release.yml: 1

25-25: LGTM!

📝 Walkthrough

The lint, release, test, and typecheck workflows now install dependencies with yarn install --frozen-lockfile, requiring installation to use the existing lockfile.

Changes: CI Dependency Installs

Layer / File(s)	Summary
Workflow dependency installation .github/workflows/lint.yml, .github/workflows/test.yml, .github/workflows/typecheck.yml, .github/workflows/release.yml	Each workflow uses yarn install --frozen-lockfile instead of yarn to install dependencies.

Priority: ➖ Normal

Estimated code review effort: 1 (Trivial) | ~3 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to 964c6

The workflows should fail on lockfile drift as intended and remain mergeable.

Pre-merge checks: 4

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title contains the valid Jira ticket ID PER-8766 and clearly describes the change to use --frozen-lockfile in CI and release workflows.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[rishigupta1599]

Claude Code PR Review

PR: #669 • Head: 964c628 • Reviewers: stack:code-review, stack-percy-docs-reviewer

Summary

Switches the bare yarn install to yarn install --frozen-lockfile in the release, lint, typecheck and test workflows. A drifted yarn.lock now fails CI and release instead of being re-resolved before npm publish (PER-8766).

Review Table

Priority	Category	Check	Status	Notes
High	Security	No hardcoded secrets or credentials	Pass	NODE_AUTH_TOKEN stays scoped to the npm publish step
High	Security	Authentication/authorization checks present	N/A	CI config only
High	Security	Input validation and sanitization	N/A
High	Security	No IDOR — resource ownership validated	N/A
High	Security	No SQL injection (parameterized queries)	N/A
High	Correctness	Logic is correct, handles edge cases	Pass	All four installs swapped. The test.yml workflow_dispatch cli block is correctly left alone: it installs another checkout and runs yarn remove/yarn link
High	Correctness	Error handling is explicit, no swallowed exceptions	Pass	A lockfile mismatch now fails the step
High	Correctness	No race conditions or concurrency issues	N/A
Medium	Testing	New code has corresponding tests	N/A	CI config. Lockfile verified in sync on node 18 and 20
Medium	Testing	Error paths and edge cases tested	N/A
Medium	Testing	Existing tests still pass (no regressions)	Pass	Lint and Typecheck are green with the frozen install
Medium	Performance	No N+1 queries or unbounded data fetching	N/A
Medium	Performance	Long-running tasks use background jobs	N/A
Medium	Quality	Follows existing codebase patterns	Pass
Medium	Quality	Changes are focused (single concern)	Pass	4 one-line changes
Low	Quality	Meaningful names, no dead code	Pass
Low	Quality	Comments explain why, not what	N/A
Low	Quality	No unnecessary dependencies added	Pass	No dependency changes

Findings

• File: .github/workflows/release.yml:25
• Severity: Low
• Reviewer: stack:code-review
• Issue: yarn v1's --frozen-lockfile can pass when a dependency was removed from package.json but yarn.lock was not regenerated (yarn#5840).
• Suggestion: Optional follow-up: add git diff --exit-code yarn.lock after the install, or move to npm ci or Yarn Berry --immutable.

Pre-existing (not gating)

• ::set-output is deprecated in all four workflows. Use echo "dir=..." >> "$GITHUB_OUTPUT" instead. Separate concern, unchanged by this PR.
• npm publish in release.yml runs without --provenance or id-token: write. This is a possible follow-up hardening step.

Knowledge coverage (stack-percy-docs-reviewer): N/A. This is a non-architectural CI change.

---

Verdict: PASS