From 2590812f8f45c25dfc0be25efe6f373c057ee9d2 Mon Sep 17 00:00:00 2001
From: Shavonn Brown <shavonn@offloadproject.com>
Date: Sun, 28 Jun 2026 10:48:46 -0400
Subject: [PATCH] fix: use npm ci install command

---
 scripts/finalize-release.sh | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/scripts/finalize-release.sh b/scripts/finalize-release.sh
index 3c35bce..c7323f2 100755
--- a/scripts/finalize-release.sh
+++ b/scripts/finalize-release.sh
@@ -84,7 +84,13 @@ main() {
 
     if [[ -n "${INPUT_NPM_BUILD_COMMAND:-}" ]]; then
       echo "Running build: ${INPUT_NPM_BUILD_COMMAND}"
-      npm install
+      # Prefer `npm ci` for reproducible installs from the lockfile; fall back to
+      # `npm install` when the repo has no lockfile (ci requires one).
+      if [[ -f package-lock.json || -f npm-shrinkwrap.json ]]; then
+        npm ci
+      else
+        npm install
+      fi
       eval "$INPUT_NPM_BUILD_COMMAND"
     fi