dangernoodle-io / TaipanMiner / 25000811472

90%

push

github

build: pin idf component manager + use npm ci for reproducibility (#223)

Two reproducibility leaks were producing CI binaries that diverge from
local builds even with identical source. The CI-built v0.15.1 release
binary task-watchdog reboots on tdongle while a local build of the same
commit is stable; the binaries differ by 377 KB.

- Track dependencies.lock so the IDF Component Manager pulls the same
  espressif/mdns version (1.11.0) every CI run instead of resolving
  the ~1.11.0 constraint fresh.
- Use npm ci instead of npm install in release.yml and build.yml so
  webui dependencies match webui/package-lock.json exactly.

Refs TA-261.

Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>

368 of 438 branches covered (84.02%)

Branch coverage included in aggregate %.

918 of 949 relevant lines covered (96.73%)

438238.04 hits per line