chore(deps): add npm release age constraint for @kilocode/cli by greenc-FNAL · Pull Request #801 · Framework-R-D/phlex

greenc-FNAL · 2026-08-04T22:06:25Z

Set min-release-age=3 to defer installation of npm packages released within
the last 3 days, reducing risk of installing unstable prereleases
Add .npmrc config file to persist this setting across builds
Update Dockerfile to configure npm before installing @kilocode/cli

Build system
- Add .npmrc with min-release-age=3.
- Configure npm with the three-day release-age limit before installing @kilocode/cli in .devcontainer/Dockerfile.
- Defer installation of packages released within the previous three days.
CI
- Update the Markdown Fix and YAML Fix workflows to use Node.js v26.
- Disable the setup-node package-manager cache to avoid stale npm dependencies.
- Install markdownlint-cli2 with a multiline shell command in the Markdown Fix workflow.

- Set min-release-age=3 to defer installation of npm packages released within the last 3 days, reducing risk of installing unstable prereleases - Add .npmrc config file to persist this setting across builds - Update Dockerfile to configure npm before installing @kilocode/cli

coderabbitai · 2026-08-04T22:06:44Z

Important

Review skipped

Auto incremental reviews are disabled on this repository.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: accdf615-ec7b-4ed3-ae20-2a076563011a

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

📝 Walkthrough

Walkthrough

The change sets npm’s min-release-age value to 3 and updates both formatting workflows to Node.js 26 with package-manager caching disabled.

Changes

Configuration updates

Layer / File(s)	Summary
Configure minimum package release age `.devcontainer/Dockerfile`, `.npmrc`	The devcontainer and repository npm configuration require packages to be at least three days old before use.
Update workflow Node.js setup `.github/workflows/markdown-fix.yaml`, `.github/workflows/yaml-fix.yaml`	Both workflows use Node.js 26 and disable package-manager caching. The Markdown Fix workflow uses a multiline `markdownlint-cli2` installation command.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

Framework-R-D/phlex#681: Updates the devcontainer and global @kilocode/cli npm installation configuration.

Suggested reviewers: knoepfel

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely identifies the main change: adding an npm release-age constraint for `@kilocode/cli`.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch maintenance/npm-armor

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.npmrc:
- Line 1: Update the markdown-fix workflow’s markdownlint-cli2 installation step
to use npm 11.10 or newer, either by configuring its npm-version override or by
selecting a Node release that bundles a supported npm version; ensure the
existing min-release-age setting is recognized during npm install.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: ea729bab-8999-4a01-bd10-335f39ef070f

📥 Commits

Reviewing files that changed from the base of the PR and between 11de634 and f1465be.

📒 Files selected for processing (2)

.devcontainer/Dockerfile
.npmrc

📜 Review details

🔇 Additional comments (2)

.devcontainer/Dockerfile (1)

107-107: LGTM!

.npmrc (1)

1-1: 🔒 Security & Privacy

Security Misconfiguration (CWE-16)

Reachability: External

Verify project configuration for global installs.

Line [1] is a project .npmrc setting. npm does not read project .npmrc files in global mode. The shown workflow commands use npm install -g, so they bypass this setting unless they also configure userconfig, an environment variable, or a command-line flag. Apply the policy at user scope or directly on each global install. (docs.npmjs.com)

- Update setup-node to Node.js v26 (released 2026-04) - Disable package-manager-cache to avoid stale npm dependencies - No effect on workflow output; ensures consistent, up-to-date tooling

greenc-FNAL · 2026-08-05T01:10:42Z

@coderabbitai review

coderabbitai · 2026-08-05T01:10:49Z

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

Copilot

Pull request overview

This PR reduces npm supply-chain risk by enforcing a minimum “release age” before newly published package versions are eligible for installation, and updates the auto-fix workflows/devcontainer to align with that policy.

Changes:

Add .npmrc to set min-release-age=3.
Configure npm with min-release-age=3 in the devcontainer before installing @kilocode/cli.
Update Markdown/YAML fix workflows to use Node.js 26 and disable setup-node’s package-manager cache.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

File	Description
`.npmrc`	Adds repo-level npm policy to defer installing very new releases.
`.github/workflows/yaml-fix.yaml`	Updates Node version and disables setup-node package-manager caching for the YAML fixer workflow.
`.github/workflows/markdown-fix.yaml`	Updates Node version, disables setup-node package-manager caching, and switches markdownlint install step to a multiline run block.
`.devcontainer/Dockerfile`	Sets npm `min-release-age` prior to installing `@kilocode/cli` in the devcontainer image.

Suppressed comments (1)

.npmrc:2

The new .npmrc currently has a trailing blank line (line 2 is empty). Repo guidelines require text files to end with exactly one newline and no extra blank lines at EOF; this extra line can trip whitespace/EOF fixers.

min-release-age=3

Install npm 11.10.0+ before running format tools in markdown-fix.yaml and yaml-fix.yaml workflows, and update devcontainer Dockerfile to ensure a recent npm version. This prevents failures from older npm versions that may not support required package features. Fixes node-version "26" → "26" (no change, explicit version for clarity).

Copilot

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated no new comments.

Suppressed comments (2)

.github/workflows/markdown-fix.yaml:115

min-release-age=3 is added in the repo’s .npmrc, but this step runs outside the checkout directory (the repo is checked out into ${{ needs.setup.outputs.checkout_path }}), so npm likely won’t read the project .npmrc and the cooldown won’t apply to this global install. Set working-directory to the checkout path (or set the config in user/global scope) so the constraint is actually enforced here.

      - name: Install markdownlint-cli2
        run: |
          npm install -g markdownlint-cli2

.github/workflows/yaml-fix.yaml:116

min-release-age=3 is committed as a project .npmrc, but this global install runs from the default working directory rather than the checkout directory (${{ needs.setup.outputs.checkout_path }}), so npm likely won’t pick up the project config and the release-age constraint won’t be applied. Run this step from the checkout path (or set the config in user/global scope).

      - name: Install prettier
        run: |
          npm install -g prettier

knoepfel

How is the top-level .npmrc file used? It would be nice if it didn't have to go in the top-level directory of the repository, which is already cluttered with many files.

greenc-FNAL · 2026-08-05T14:01:55Z

How is the top-level .npmrc file used? It would be nice if it didn't have to go in the top-level directory of the repository, which is already cluttered with many files.

Good call: this is an AI mistake. The "project-level" .npmrc file is only valid where npm_modules is a sibling, and is not read at all for global (-g) installs.

I will set it at the user level instead of relying on a file (cf .devcontainer/Dockerfile).

greenc-FNAL requested a review from knoepfel August 4, 2026 22:06

coderabbitai Bot reviewed Aug 4, 2026

View reviewed changes

Comment thread .npmrc Outdated

chore(ci): update Node.js to v26 in markdown/yaml fix workflows

37b91eb

- Update setup-node to Node.js v26 (released 2026-04) - Disable package-manager-cache to avoid stale npm dependencies - No effect on workflow output; ensures consistent, up-to-date tooling

greenc-FNAL requested review from aolivier23, marcpaterno and sabasehrish as code owners August 5, 2026 01:09

greenc-FNAL requested a lite review from Copilot August 5, 2026 01:11

Copilot started reviewing on behalf of greenc-FNAL August 5, 2026 01:11 View session

Copilot AI reviewed Aug 5, 2026

View reviewed changes

Comment thread .devcontainer/Dockerfile

greenc-FNAL requested a lite review from Copilot August 5, 2026 01:25

Copilot started reviewing on behalf of greenc-FNAL August 5, 2026 01:26 View session

Copilot AI reviewed Aug 5, 2026

View reviewed changes

knoepfel reviewed Aug 5, 2026

View reviewed changes

Rely on setting npm user-level config

ba7100c

knoepfel approved these changes Aug 5, 2026

View reviewed changes

knoepfel merged commit 7a82e4f into main Aug 5, 2026
1 check passed

knoepfel deleted the maintenance/npm-armor branch August 5, 2026 14:29

Navigation Menu

Uh oh!

chore(deps): add npm release age constraint for @kilocode/cli - #801

chore(deps): add npm release age constraint for @kilocode/cli#801
knoepfel merged 4 commits into
mainfrom
maintenance/npm-armor

greenc-FNAL commented Aug 4, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Aug 4, 2026 •

edited

Loading

Review skipped

Walkthrough

Changes

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

greenc-FNAL commented Aug 5, 2026

Uh oh!

coderabbitai Bot commented Aug 5, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

knoepfel left a comment

Uh oh!

greenc-FNAL commented Aug 5, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

greenc-FNAL commented Aug 4, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai Bot commented Aug 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Walkthrough

Changes

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

greenc-FNAL commented Aug 5, 2026

Uh oh!

coderabbitai Bot commented Aug 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

knoepfel left a comment

Choose a reason for hiding this comment

Uh oh!

greenc-FNAL commented Aug 5, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

greenc-FNAL commented Aug 4, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Aug 4, 2026 •

edited

Loading

coderabbitai Bot commented Aug 5, 2026 •

edited

Loading