ethernet f8ddf4fd86 feat(ci): semantic package-lock.json diff as an upserted PR comment (#65206) ... git diff on a lockfile is unreadable: npm reorders entries, rewrites integrity hashes, and moves packages between nesting levels, so a one-line package.json bump produces a thousand-line textual diff. scripts/ci/lockfile_diff.py instead parses the `packages` map out of both versions of every tracked package-lock.json (via `git show`), reduces each to {install path: version}, and set-diffs the maps — reorder/hash churn vanishes, leaving only actual version movement (added / removed / updated, with nested dedup copies tracked separately). The lockfile-diff workflow posts the result as a Markdown table in a PR comment gated behind a hidden marker: subsequent pushes PATCH the existing comment instead of stacking new ones, and a push that reverts all lockfile changes updates the comment to say so. Advisory only — never fails on findings; fork PRs (read-only token) degrade to a warning. Wired through the ci.yml orchestrator with a new npm_lock lane in classify_changes.py (fails open on .github/ changes per the existing contract).		2026-07-16 03:18:15 +00:00
..
action.yml	feat(ci): semantic package-lock.json diff as an upserted PR comment (#65206)	2026-07-16 03:18:15 +00:00