fix(ci): run validate without a package-lock.json

[Ed Fricker (beastawakens)]

User description

Summary

The validate workflow has been failing on every PR (including the first sync PR #1 from smileidentity/lambda's automated sync workflow):

##[error]Dependencies lock file is not found ... Supported file patterns: package-lock.json, npm-shrinkwrap.json, yarn.lock

Two reasons:

• actions/setup-node with cache: npm requires a lockfile to compute the cache key.
• npm ci requires a lockfile to install.

The repo doesn't commit one. Switching the workflow to invoke spectral and redocly directly via npx --yes (pinned to the same versions as package.json's devDependencies) drops both requirements.

This unblocks sync PR #1 and any future automated sync PRs from lambda.

Test plan

• CI passes on this PR
• After merge, kick sync PR chore: sync v3 specs from lambda v3.549.0 #1 (push an empty commit, or close-and-reopen) to re-run validate against the fix

🤖 Generated with Claude Code

---

PR Type

Bug fix

---

Description

• Fix CI workflow failing due to missing package-lock.json

• Remove cache: npm and npm ci steps from validate workflow

• Use npx --yes with pinned package versions directly

• Unblocks automated sync PRs from lambda repo

---

Diagram Walkthrough

flowchart LR
  A["validate.yml"] -- "remove" --> B["cache: npm + npm ci"]
  A -- "add" --> C["npx --yes with pinned versions"]
  C -- "runs" --> D["spectral-cli@^6.14.0"]
  C -- "runs" --> E["@redocly/cli@^1.28.0"]

Loading

File Walkthrough

	Relevant files
Bug fix	validate.yml Remove lockfile dependency from CI validate workflow          .github/workflows/validate.yml Removed cache: npm option from actions/setup-node step Removed npm ci install step entirely Changed npx spectral to npx --yes @stoplight/spectral-cli@^6.14.0 Changed npx redocly to npx --yes @redocly/cli@^1.28.0 +3/-6

---

---

Need help?

Type /help how to ... in the comments thread for any questions about PR-Agent usage.

Check out the documentation for more information.

[prfectionist]

PR Reviewer Guide 🔍

Here are some key observations to aid the review process:

🎫 Ticket compliance analysis 🔶 1 - Partially compliant Compliant requirements: (This PR is a CI fix, not the sync PR itself. It unblocks the sync PR #1.) Non-compliant requirements: (Not applicable - this PR fixes CI to unblock the ticket's sync PR, it does not implement the sync itself.) Requires further human verification: Verify that after this PR merges, sync PR chore: sync v3 specs from lambda v3.549.0 #1 CI passes successfully

⏱️ Estimated effort to review: 1 🔵⚪⚪⚪⚪

🏅 Score: 85

🧪 No relevant tests

🔒 No security concerns identified

🔀 No multiple PR themes

⚡ Recommended focus areas for review Performance Each npx --yes invocation downloads the package fresh every time since there's no caching. The workflow now downloads @stoplight/spectral-cli twice (lines 25 and 31) and @redocly/cli once per run. This adds network latency and makes builds slower and less reproducible. Consider installing the packages once (e.g., npm install without a lockfile, or a single npm exec step) and reusing them, or at minimum caching the npm store. run: npx --yes @stoplight/spectral-cli@^6.14.0 lint specs/v3/*.yaml --fail-severity error - name: Bundle OpenAPI specs run: npx --yes @redocly/cli@^1.28.0 bundle specs/v3/*.yaml -o bundled/openapi-v3.yaml - name: Verify bundled spec is valid run: npx --yes @stoplight/spectral-cli@^6.14.0 lint bundled/openapi-v3.yaml --fail-severity error Non-deterministic Builds Using caret ranges (^6.14.0, ^1.28.0) means different CI runs may resolve different patch/minor versions, leading to non-reproducible results. Pinning to exact versions (e.g., @stoplight/spectral-cli@6.14.0) would ensure consistent behavior across runs. run: npx --yes @stoplight/spectral-cli@^6.14.0 lint specs/v3/*.yaml --fail-severity error - name: Bundle OpenAPI specs run: npx --yes @redocly/cli@^1.28.0 bundle specs/v3/*.yaml -o bundled/openapi-v3.yaml - name: Verify bundled spec is valid run: npx --yes @stoplight/spectral-cli@^6.14.0 lint bundled/openapi-v3.yaml --fail-severity error

[prfectionist]

PR Code Suggestions ✨

No code suggestions found for the PR.

[Copilot]

Pull request overview

Updates the GitHub Actions validate workflow to run Spectral and Redocly via npx so CI can validate OpenAPI specs without requiring a committed lockfile (and without npm ci).

Changes:

• Remove actions/setup-node npm caching and the npm ci install step (no lockfile required).
• Run Spectral linting and Redocly bundling directly via npx --yes with explicit package/version selectors.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.