czcdr 849863841d ci: gate the vendored dependency closure in both validate jobs ...

`npm run bundle:deps` now runs after the manifest audit on Linux and on Windows,
so a lock that drifts back onto an advisory-affected zod/minimatch/glob — or onto
a rea-agents release the manifest does not pin — fails the build instead of only
being caught on the machine that provisioned it. The gate is offline, which is the
point: one that needs the registry fails on a plane and passes during an outage.

The earlier commit had to leave this out because the push credential had no
GitHub `workflow` scope; with a scoped credential it lands here.

2026-11-06 23:19:29 +08:00

..

release.yml

shim/setup: fix the wedging stale lock, drop the 1.x examples, and close the second audit

2026-10-17 00:04:04 +08:00

validate.yml

ci: gate the vendored dependency closure in both validate jobs

2026-11-06 23:19:29 +08:00