Avoid unreachable Gitea runner cache

.gitea/workflows/cms-content-validation.yml

@@ -20,8 +20,6 @@ jobs:
         uses: https://github.com/actions/setup-node@v4
         with:
           node-version: 22
-          cache: npm
-          cache-dependency-path: package-lock.json
       - name: Install locked dependencies
         run: npm ci --prefer-offline --no-audit --no-fund
       - name: Verify Decap configuration and content boundaries

.gitea/workflows/deploy-blog.yml

@@ -33,8 +33,6 @@ jobs:
         uses: https://github.com/actions/setup-node@v4
         with:
           node-version: 22
-          cache: npm
-          cache-dependency-path: package-lock.json
       - name: Install locked dependencies
         run: npm ci --prefer-offline --no-audit --no-fund
       - name: Validate and build selected site

.gitea/workflows/deploy.yml

@@ -33,8 +33,6 @@ jobs:
         uses: https://github.com/actions/setup-node@v4
         with:
           node-version: 22
-          cache: npm
-          cache-dependency-path: package-lock.json
       - name: Install locked dependencies
         run: npm ci --prefer-offline --no-audit --no-fund
       - name: Validate and build selected site

.gitea/workflows/production-blog.yml

@@ -34,8 +34,6 @@ jobs:
         uses: https://github.com/actions/setup-node@v4
         with:
           node-version: 22
-          cache: npm
-          cache-dependency-path: package-lock.json
       - name: Install locked dependencies
         run: npm ci --prefer-offline --no-audit --no-fund
       - name: Validate and build production blog

.gitea/workflows/production-candidate.yml

@@ -34,8 +34,6 @@ jobs:
         uses: https://github.com/actions/setup-node@v4
         with:
           node-version: 22
-          cache: npm
-          cache-dependency-path: package-lock.json
       - name: Install locked dependencies
         run: npm ci --prefer-offline --no-audit --no-fund
       - name: Validate and build production site

docs/decap-cms-pilot.md

@@ -81,9 +81,14 @@ the pilot:
 - The existing branch preview workflows remain in place. Local output checks
   now prove preview robots rules and page metadata stay no-index and that the
   admin response has a no-index header rule.
-- Validation, preview, and production workflows cache npm's download store by
+- Validation, preview, and production workflows use clean `npm ci` installs with
-  `package-lock.json` while retaining clean `npm ci` installs. Warm runner jobs
+  `--prefer-offline --no-audit --no-fund`. Do not enable `setup-node`'s npm cache
-  avoid repeatedly downloading the same dependency tarballs.
+  until the Actions runner cache service is reachable from job containers. The
+  September 4 pilot test timed out against the runner's auto-detected private
+  address during both cache restore and cleanup. Give `act_runner` a fixed
+  `cache.host` and `cache.port` reachable from its job containers, publish that
+  port (or attach runner and jobs to a shared network), restart the runner, and
+  then restore the lockfile-keyed `cache: npm` configuration.
 
 The pilot dependencies are active: the public client ID, exact-origin CORS
 policy, `cms-pilot` branch, and both protection rules have been verified.

scripts/verify-decap.mjs

@@ -227,8 +227,7 @@ for (const path of [
   '.gitea/workflows/production-blog.yml',
 ]) {
   const text = await readFile(path, 'utf8');
-  assert(/cache:\s*npm/.test(text) && /cache-dependency-path:\s*package-lock\.json/.test(text), `${path} must cache npm downloads by package-lock.json.`);
+  assert(text.includes('npm ci --prefer-offline --no-audit --no-fund'), `${path} must retain a clean lockfile install with quiet, cache-friendly npm options.`);
-  assert(text.includes('npm ci --prefer-offline --no-audit --no-fund'), `${path} must retain a clean lockfile install while preferring the cache.`);
 }
 
 console.log('Verified Decap backend, four content contracts, fixed page images, bounded media, admin pin, and stable PR status context.');