Follow-up to #38782. The workflow's server-readiness step used
`npx --yes wait-on`, which fetched the latest wait-on tarball from
npm on every run — non-reproducible, and any compromised release of
wait-on or its transitive deps would run in CI with GITHUB_TOKEN
access.
Adding wait-on as a pinned devDep would fix reproducibility but pull
21 transitive packages (axios, joi, rxjs, @hapi/joi stack) into
package-lock.json just to poll an HTTP endpoint. Replace it with a
one-liner curl retry loop instead — curl ships on every runner, no
npm fetch, no lockfile change, same 10-minute cap.
Reported by @NARSimoes on #38782.
Co-authored-by: Cursor <cursoragent@cursor.com>
Eva SarafianouandCursor
9026858eb6