What's broken
Every CI job that runs `npm ci` (lint-check, Spec Validation "validate", Features Check, and the npm-touching steps under "Code Quality") currently fails on `development` and on every PR, with:
```
npm error code EUSAGE
npm error `npm ci` can only install packages when your package.json and package-lock.json or npm-shrinkwrap.json are in sync. Please update your lock file with `npm install` before continuing.
npm error
npm error Missing: picomatch@4.0.5 from lock file
```
Root cause
`package-lock.json` (lockfileVersion 3, generated by a modern npm — 11.x locally reproduces it byte-for-byte with no diff) is not accepted by the npm 10.8.2 / Node 20.20.2 toolchain the workflows currently provision (`actions/setup-node@v4` without a pinned npm version, or an older `engines` range). Running `npm install` locally with npm 11.13.0 / Node 22.22.0 reproduces the committed lock file exactly — the lock file itself is not the problem; the CI runner's older npm is stricter about it.
`package.json` already declares `"engines": { "node": "^24.0.0", "npm": "^11.3.0" }`, so the intent is clearly a newer toolchain than what the GitHub Actions workflows currently set up.
Confirmed pre-existing
Verified this predates and is unrelated to #97 (add-migration-safety-guard) — that PR's commit does not touch `package.json` or `package-lock.json` at all, and the same `npm ci` failure was already present on `development` immediately after merging #97 (i.e. it was already broken beforehand).
Suggested fix
Pin/bump the Node version used by `actions/setup-node` in the affected workflows (`.github/workflows/*`) to Node 24 (or otherwise ensure npm >= 11 is used for `npm ci`), matching the `engines` field already declared in `package.json`.
What's broken
Every CI job that runs `npm ci` (lint-check, Spec Validation "validate", Features Check, and the npm-touching steps under "Code Quality") currently fails on `development` and on every PR, with:
```
npm error code EUSAGE
npm error `npm ci` can only install packages when your package.json and package-lock.json or npm-shrinkwrap.json are in sync. Please update your lock file with `npm install` before continuing.
npm error
npm error Missing: picomatch@4.0.5 from lock file
```
Root cause
`package-lock.json` (lockfileVersion 3, generated by a modern npm — 11.x locally reproduces it byte-for-byte with no diff) is not accepted by the npm 10.8.2 / Node 20.20.2 toolchain the workflows currently provision (`actions/setup-node@v4` without a pinned npm version, or an older `engines` range). Running `npm install` locally with npm 11.13.0 / Node 22.22.0 reproduces the committed lock file exactly — the lock file itself is not the problem; the CI runner's older npm is stricter about it.
`package.json` already declares `"engines": { "node": "^24.0.0", "npm": "^11.3.0" }`, so the intent is clearly a newer toolchain than what the GitHub Actions workflows currently set up.
Confirmed pre-existing
Verified this predates and is unrelated to #97 (add-migration-safety-guard) — that PR's commit does not touch `package.json` or `package-lock.json` at all, and the same `npm ci` failure was already present on `development` immediately after merging #97 (i.e. it was already broken beforehand).
Suggested fix
Pin/bump the Node version used by `actions/setup-node` in the affected workflows (`.github/workflows/*`) to Node 24 (or otherwise ensure npm >= 11 is used for `npm ci`), matching the `engines` field already declared in `package.json`.