From 9026858eb61bc4418dd9071a287cba07aaf9dd2f Mon Sep 17 00:00:00 2001 From: Eva Sarafianou Date: Fri, 25 Sep 2026 19:30:14 +0300 Subject: [PATCH] docs-ime-render: replace npx wait-on with curl poll (#38787) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Follow-up to #38782. The workflow's server-readiness step used `npx --yes wait-on`, which fetched the latest wait-on tarball from npm on every run — non-reproducible, and any compromised release of wait-on or its transitive deps would run in CI with GITHUB_TOKEN access. Adding wait-on as a pinned devDep would fix reproducibility but pull 21 transitive packages (axios, joi, rxjs, @hapi/joi stack) into package-lock.json just to poll an HTTP endpoint. Replace it with a one-liner curl retry loop instead — curl ships on every runner, no npm fetch, no lockfile change, same 10-minute cap. Reported by @NARSimoes on #38782. Co-authored-by: Cursor --- .github/workflows/docs-ime-render.yml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/.github/workflows/docs-ime-render.yml b/.github/workflows/docs-ime-render.yml index 2950e0539ca..f0e78713a6c 100644 --- a/.github/workflows/docs-ime-render.yml +++ b/.github/workflows/docs-ime-render.yml @@ -66,8 +66,11 @@ jobs: echo "docusaurus pid $!" - name: render/wait-for-server + # Poll with curl instead of `npx wait-on` — the runner already + # ships curl, so this avoids fetching a wait-on tarball (and its + # ~20 transitive deps) from npm at run time. run: | - npx --yes wait-on --timeout 600000 --httpTimeout 5000 http://localhost:3000 + timeout 600 bash -c 'until curl -sSf --max-time 5 http://localhost:3000 > /dev/null; do sleep 2; done' - name: render/render-ime working-directory: docs/site