From e90b0ecf6432ad26970575a261386db218726b0b Mon Sep 17 00:00:00 2001 From: don-petry <36422719+don-petry@users.noreply.github.com> Date: Tue, 13 Oct 2026 21:55:31 +0000 Subject: [PATCH 1/4] =?UTF-8?q?feat:=20implement=20issue=20#504=20?= =?UTF-8?q?=E2=80=94=20SonarCloud:=20miscellaneous=20findings?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .../azure-pipelines-template.yaml | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) diff --git a/.github/skills/bmad-testarch-ci/azure-pipelines-template.yaml b/.github/skills/bmad-testarch-ci/azure-pipelines-template.yaml index 75ee46a7..6461cd6b 100644 --- a/.github/skills/bmad-testarch-ci/azure-pipelines-template.yaml +++ b/.github/skills/bmad-testarch-ci/azure-pipelines-template.yaml @@ -4,10 +4,12 @@ # Stack: {test_stack_type} | Framework: {test_framework} # # Variables to customize per project: -# INSTALL_CMD - dependency install command (e.g., npm ci, pnpm install --frozen-lockfile) +# INSTALL_CMD - dependency install command (e.g., npm ci --ignore-scripts, pnpm install --frozen-lockfile --ignore-scripts) # TEST_CMD - main test command (e.g., npm run test:e2e, npm test, npx vitest) # LINT_CMD - lint command (e.g., npm run lint) -# BROWSER_INSTALL - browser install command (frontend/fullstack only; omit for backend) +# BROWSER_INSTALL - browser install command using the lockfile-pinned local binary +# (e.g., ./node_modules/.bin/playwright install --with-deps chromium; +# frontend/fullstack only; omit for backend) # DEFAULT_NODE_VERSION - Node.js version (read from .nvmrc or default to 24) trigger: @@ -51,7 +53,7 @@ stages: path: $(npm_config_cache) displayName: "Cache npm" - - script: npm ci + - script: npm ci --ignore-scripts displayName: "Install dependencies" # Replace with INSTALL_CMD - script: npm run lint @@ -90,11 +92,11 @@ stages: path: $(npm_config_cache) displayName: "Cache npm" - - script: npm ci + - script: npm ci --ignore-scripts displayName: "Install dependencies" # Replace with INSTALL_CMD # Frontend/Fullstack only — skipped for backend-only stacks - - script: npx playwright install --with-deps chromium + - script: ./node_modules/.bin/playwright install --with-deps chromium condition: ne(variables['TEST_STACK_TYPE'], 'backend') displayName: "Install Playwright browsers" # Replace with BROWSER_INSTALL @@ -132,11 +134,11 @@ stages: versionSpec: $(DEFAULT_NODE_VERSION) displayName: "Setup Node.js" - - script: npm ci + - script: npm ci --ignore-scripts displayName: "Install dependencies" # Replace with INSTALL_CMD # Frontend/Fullstack only — skipped for backend-only stacks - - script: npx playwright install --with-deps chromium + - script: ./node_modules/.bin/playwright install --with-deps chromium condition: ne(variables['TEST_STACK_TYPE'], 'backend') displayName: "Install Playwright browsers" # Replace with BROWSER_INSTALL From 3afdb18cc3f951f7666feedee412735ee03d86ae Mon Sep 17 00:00:00 2001 From: don-petry <36422719+don-petry@users.noreply.github.com> Date: Tue, 13 Oct 2026 22:00:20 +0000 Subject: [PATCH 2/4] fix(reviews): use npx --no-install for Playwright and document ignore-scripts rebuild Co-Authored-By: Claude Sonnet 5.5 --- .../skills/bmad-testarch-ci/azure-pipelines-template.yaml | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/.github/skills/bmad-testarch-ci/azure-pipelines-template.yaml b/.github/skills/bmad-testarch-ci/azure-pipelines-template.yaml index 6461cd6b..f6116434 100644 --- a/.github/skills/bmad-testarch-ci/azure-pipelines-template.yaml +++ b/.github/skills/bmad-testarch-ci/azure-pipelines-template.yaml @@ -5,10 +5,12 @@ # # Variables to customize per project: # INSTALL_CMD - dependency install command (e.g., npm ci --ignore-scripts, pnpm install --frozen-lockfile --ignore-scripts) +# NOTE: --ignore-scripts skips dependency lifecycle scripts (SonarCloud S6505); if a +# dependency needs preinstall/postinstall/prepare, add an explicit `npm rebuild ` step. # TEST_CMD - main test command (e.g., npm run test:e2e, npm test, npx vitest) # LINT_CMD - lint command (e.g., npm run lint) # BROWSER_INSTALL - browser install command using the lockfile-pinned local binary -# (e.g., ./node_modules/.bin/playwright install --with-deps chromium; +# (e.g., npx --no-install playwright install --with-deps chromium; # frontend/fullstack only; omit for backend) # DEFAULT_NODE_VERSION - Node.js version (read from .nvmrc or default to 24) @@ -96,7 +98,7 @@ stages: displayName: "Install dependencies" # Replace with INSTALL_CMD # Frontend/Fullstack only — skipped for backend-only stacks - - script: ./node_modules/.bin/playwright install --with-deps chromium + - script: npx --no-install playwright install --with-deps chromium condition: ne(variables['TEST_STACK_TYPE'], 'backend') displayName: "Install Playwright browsers" # Replace with BROWSER_INSTALL @@ -138,7 +140,7 @@ stages: displayName: "Install dependencies" # Replace with INSTALL_CMD # Frontend/Fullstack only — skipped for backend-only stacks - - script: ./node_modules/.bin/playwright install --with-deps chromium + - script: npx --no-install playwright install --with-deps chromium condition: ne(variables['TEST_STACK_TYPE'], 'backend') displayName: "Install Playwright browsers" # Replace with BROWSER_INSTALL From cc9250e454ea13917033b713be5df9d5a863beab Mon Sep 17 00:00:00 2001 From: don-petry <36422719+don-petry@users.noreply.github.com> Date: Wed, 14 Oct 2026 19:27:40 +0000 Subject: [PATCH 3/4] fix(reviews): use local playwright binary; sync hardened azure template to _bmad copy --- .../azure-pipelines-template.yaml | 9 +++++---- .../azure-pipelines-template.yaml | 19 ++++++++++++------- 2 files changed, 17 insertions(+), 11 deletions(-) diff --git a/.github/skills/bmad-testarch-ci/azure-pipelines-template.yaml b/.github/skills/bmad-testarch-ci/azure-pipelines-template.yaml index f6116434..347ff9af 100644 --- a/.github/skills/bmad-testarch-ci/azure-pipelines-template.yaml +++ b/.github/skills/bmad-testarch-ci/azure-pipelines-template.yaml @@ -9,8 +9,9 @@ # dependency needs preinstall/postinstall/prepare, add an explicit `npm rebuild ` step. # TEST_CMD - main test command (e.g., npm run test:e2e, npm test, npx vitest) # LINT_CMD - lint command (e.g., npm run lint) -# BROWSER_INSTALL - browser install command using the lockfile-pinned local binary -# (e.g., npx --no-install playwright install --with-deps chromium; +# BROWSER_INSTALL - browser install command using the lockfile-pinned local binary; avoid npx, +# which can resolve an unpinned copy from the npx cache or global bin +# (e.g., ./node_modules/.bin/playwright install --with-deps chromium; # frontend/fullstack only; omit for backend) # DEFAULT_NODE_VERSION - Node.js version (read from .nvmrc or default to 24) @@ -98,7 +99,7 @@ stages: displayName: "Install dependencies" # Replace with INSTALL_CMD # Frontend/Fullstack only — skipped for backend-only stacks - - script: npx --no-install playwright install --with-deps chromium + - script: ./node_modules/.bin/playwright install --with-deps chromium condition: ne(variables['TEST_STACK_TYPE'], 'backend') displayName: "Install Playwright browsers" # Replace with BROWSER_INSTALL @@ -140,7 +141,7 @@ stages: displayName: "Install dependencies" # Replace with INSTALL_CMD # Frontend/Fullstack only — skipped for backend-only stacks - - script: npx --no-install playwright install --with-deps chromium + - script: ./node_modules/.bin/playwright install --with-deps chromium condition: ne(variables['TEST_STACK_TYPE'], 'backend') displayName: "Install Playwright browsers" # Replace with BROWSER_INSTALL diff --git a/_bmad/tea/workflows/testarch/bmad-testarch-ci/azure-pipelines-template.yaml b/_bmad/tea/workflows/testarch/bmad-testarch-ci/azure-pipelines-template.yaml index 75ee46a7..347ff9af 100644 --- a/_bmad/tea/workflows/testarch/bmad-testarch-ci/azure-pipelines-template.yaml +++ b/_bmad/tea/workflows/testarch/bmad-testarch-ci/azure-pipelines-template.yaml @@ -4,10 +4,15 @@ # Stack: {test_stack_type} | Framework: {test_framework} # # Variables to customize per project: -# INSTALL_CMD - dependency install command (e.g., npm ci, pnpm install --frozen-lockfile) +# INSTALL_CMD - dependency install command (e.g., npm ci --ignore-scripts, pnpm install --frozen-lockfile --ignore-scripts) +# NOTE: --ignore-scripts skips dependency lifecycle scripts (SonarCloud S6505); if a +# dependency needs preinstall/postinstall/prepare, add an explicit `npm rebuild ` step. # TEST_CMD - main test command (e.g., npm run test:e2e, npm test, npx vitest) # LINT_CMD - lint command (e.g., npm run lint) -# BROWSER_INSTALL - browser install command (frontend/fullstack only; omit for backend) +# BROWSER_INSTALL - browser install command using the lockfile-pinned local binary; avoid npx, +# which can resolve an unpinned copy from the npx cache or global bin +# (e.g., ./node_modules/.bin/playwright install --with-deps chromium; +# frontend/fullstack only; omit for backend) # DEFAULT_NODE_VERSION - Node.js version (read from .nvmrc or default to 24) trigger: @@ -51,7 +56,7 @@ stages: path: $(npm_config_cache) displayName: "Cache npm" - - script: npm ci + - script: npm ci --ignore-scripts displayName: "Install dependencies" # Replace with INSTALL_CMD - script: npm run lint @@ -90,11 +95,11 @@ stages: path: $(npm_config_cache) displayName: "Cache npm" - - script: npm ci + - script: npm ci --ignore-scripts displayName: "Install dependencies" # Replace with INSTALL_CMD # Frontend/Fullstack only — skipped for backend-only stacks - - script: npx playwright install --with-deps chromium + - script: ./node_modules/.bin/playwright install --with-deps chromium condition: ne(variables['TEST_STACK_TYPE'], 'backend') displayName: "Install Playwright browsers" # Replace with BROWSER_INSTALL @@ -132,11 +137,11 @@ stages: versionSpec: $(DEFAULT_NODE_VERSION) displayName: "Setup Node.js" - - script: npm ci + - script: npm ci --ignore-scripts displayName: "Install dependencies" # Replace with INSTALL_CMD # Frontend/Fullstack only — skipped for backend-only stacks - - script: npx playwright install --with-deps chromium + - script: ./node_modules/.bin/playwright install --with-deps chromium condition: ne(variables['TEST_STACK_TYPE'], 'backend') displayName: "Install Playwright browsers" # Replace with BROWSER_INSTALL From 2f287a282a30055916130ce7bfd11cbb2c960b61 Mon Sep 17 00:00:00 2001 From: don-petry <36422719+don-petry@users.noreply.github.com> Date: Thu, 15 Oct 2026 14:44:08 +0000 Subject: [PATCH 4/4] fix(bot): clarify --ignore-scripts behavior for root-package hooks Updated documentation to explicitly address that --ignore-scripts skips both dependency lifecycle scripts AND root-package hooks (prepare, postinstall, etc.). Added guidance for handling root-package setup scripts as separate pipeline steps if required for the project stack. Addresses CodeAnt concern about compatibility and setup hook handling. Co-Authored-By: Claude Haiku 4.5 --- .../skills/bmad-testarch-ci/azure-pipelines-template.yaml | 6 ++++-- .../testarch/bmad-testarch-ci/azure-pipelines-template.yaml | 6 ++++-- 2 files changed, 8 insertions(+), 4 deletions(-) diff --git a/.github/skills/bmad-testarch-ci/azure-pipelines-template.yaml b/.github/skills/bmad-testarch-ci/azure-pipelines-template.yaml index 347ff9af..4bb55fb8 100644 --- a/.github/skills/bmad-testarch-ci/azure-pipelines-template.yaml +++ b/.github/skills/bmad-testarch-ci/azure-pipelines-template.yaml @@ -5,8 +5,10 @@ # # Variables to customize per project: # INSTALL_CMD - dependency install command (e.g., npm ci --ignore-scripts, pnpm install --frozen-lockfile --ignore-scripts) -# NOTE: --ignore-scripts skips dependency lifecycle scripts (SonarCloud S6505); if a -# dependency needs preinstall/postinstall/prepare, add an explicit `npm rebuild ` step. +# NOTE: --ignore-scripts skips ALL lifecycle scripts — both dependency scripts (preinstall/postinstall/prepare) +# AND root-package hooks (SonarCloud S6505). For dependencies needing lifecycle scripts, add explicit +# `npm rebuild ` steps. For root-package scripts (e.g., prepare hooks), run them as separate steps +# (e.g., `npm run prepare` if needed for your stack). # TEST_CMD - main test command (e.g., npm run test:e2e, npm test, npx vitest) # LINT_CMD - lint command (e.g., npm run lint) # BROWSER_INSTALL - browser install command using the lockfile-pinned local binary; avoid npx, diff --git a/_bmad/tea/workflows/testarch/bmad-testarch-ci/azure-pipelines-template.yaml b/_bmad/tea/workflows/testarch/bmad-testarch-ci/azure-pipelines-template.yaml index 347ff9af..4bb55fb8 100644 --- a/_bmad/tea/workflows/testarch/bmad-testarch-ci/azure-pipelines-template.yaml +++ b/_bmad/tea/workflows/testarch/bmad-testarch-ci/azure-pipelines-template.yaml @@ -5,8 +5,10 @@ # # Variables to customize per project: # INSTALL_CMD - dependency install command (e.g., npm ci --ignore-scripts, pnpm install --frozen-lockfile --ignore-scripts) -# NOTE: --ignore-scripts skips dependency lifecycle scripts (SonarCloud S6505); if a -# dependency needs preinstall/postinstall/prepare, add an explicit `npm rebuild ` step. +# NOTE: --ignore-scripts skips ALL lifecycle scripts — both dependency scripts (preinstall/postinstall/prepare) +# AND root-package hooks (SonarCloud S6505). For dependencies needing lifecycle scripts, add explicit +# `npm rebuild ` steps. For root-package scripts (e.g., prepare hooks), run them as separate steps +# (e.g., `npm run prepare` if needed for your stack). # TEST_CMD - main test command (e.g., npm run test:e2e, npm test, npx vitest) # LINT_CMD - lint command (e.g., npm run lint) # BROWSER_INSTALL - browser install command using the lockfile-pinned local binary; avoid npx,