mirror of
https://github.com/mattermost/mattermost.git
synced 2026-11-04 13:16:45 -06:00
Follow-up to #38782. The workflow's server-readiness step used `npx --yes wait-on`, which fetched the latest wait-on tarball from npm on every run — non-reproducible, and any compromised release of wait-on or its transitive deps would run in CI with GITHUB_TOKEN access. Adding wait-on as a pinned devDep would fix reproducibility but pull 21 transitive packages (axios, joi, rxjs, @hapi/joi stack) into package-lock.json just to poll an HTTP endpoint. Replace it with a one-liner curl retry loop instead — curl ships on every runner, no npm fetch, no lockfile change, same 10-minute cap. Reported by @NARSimoes on #38782. Co-authored-by: Cursor <cursoragent@cursor.com>