[mldangelo-oai]

Summary

Require workflow linting and production dependency audits to pass before CI succeeds or npm release validation proceeds.

Changes

• Run pinned actionlint and ShellCheck on workflow YAML and shell steps. Run offline zizmor checks on workflows and composite actions.
• Select these checks for workflow, action, and linter-configuration changes and all main pushes. Selected failures, cancellations, and skips fail the existing required Unix checks.
• Make the existing high-severity production audit blocking in CI and npm release validation.
• Document the linter scope, release-queue compatibility exception, and existing trigger exceptions. Select coverage checks by name in the existing tests.

Testing

• Workflow linters, SDK types/format, changed-file formatting, and diff checks passed.
• 17 focused workflow/skeleton tests and 292 release-automation tests passed.
• Combined with the companion CI changes: workflow linters and 327 integration tests passed.
• Hosted workflow linting and the blocking production audit passed.
• Three independent native reviews and a fresh verification pass found no actionable regressions.

Risk and rollout

Required check names stay unchanged. High or critical production advisories and audit-service failures now block package builds and npm release validation. Workflow and audit failures must be fixed before publication. There are no public CLI or runtime changes.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-30T17:56:04.136229Z	83303cd	New commits
🔒 Security Review	✅ Completed 2026-09-30T17:56:37.072376Z	83303cd	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 5f519627bd

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[soyeon-oai]

Reviewed workflow selection and aggregate gating, pinned lint installation, production audit propagation, and release dependencies. No actionable findings. Inspected successful hosted CI/lint evidence; no independent test execution.

[Copilot]

Copilot review overview

🟢 Approval recommended

The workflow gates, blocking audits, configuration, documentation, and focused tests are consistent and complete.

Review effort: Balanced
Findings: None

What changed in this PR

Adds required workflow linting and makes production dependency audits blocking in CI and release validation.

Changes:

• Adds actionlint, ShellCheck, and zizmor workflow checks.
• Integrates workflow checks into required Unix CI gates.
• Enforces production dependency audit failures and documents policies.

File	Description
.github/​actionlint.yaml	Configures release-queue lint exceptions.
.github/​zizmor.yml	Documents privileged-trigger exceptions.
.github/​workflows/​workflow-quality.yml	Defines pinned workflow linting checks.
.github/​workflows/​node-ci.yml	Selects and gates workflow checks and audits.
.github/​workflows/​node-release.yml	Makes release audits blocking.
.github/​workflows/​native-unix.yml	Clarifies empty PATH assignments.
.github/​workflows/​container-release.yml	Disables Bun caching during release verification.
CONTRIBUTING.md	Documents workflow and audit checks.
RELEASING.md	Documents blocking production audits.
sdk/​typescript/​tests-ts/​workflow-quality.test.ts	Tests workflow-check selection and gating.
sdk/​typescript/​tests-ts/​skeleton.test.ts	Updates CI structure and audit assertions.
sdk/​typescript/​tests-ts/​release-automation.test.ts	Selects coverage gates by step name.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.