From 6fa54a23d9bdad116cafbf7a6aeb3d7a1dd267c0 Mon Sep 17 00:00:00 2001
From: Kevin <ksloan90@gmail.com>
Date: Fri, 4 Sep 2026 02:01:29 -0400
Subject: [PATCH] Cache npm downloads in Gitea workflows

---
 .gitea/workflows/cms-content-validation.yml |  4 +++-
 .gitea/workflows/deploy-blog.yml            |  4 +++-
 .gitea/workflows/deploy.yml                 |  4 +++-
 .gitea/workflows/production-blog.yml        |  4 +++-
 .gitea/workflows/production-candidate.yml   |  4 +++-
 docs/decap-cms-pilot.md                     |  3 +++
 scripts/verify-decap.mjs                    | 11 +++++++++++
 7 files changed, 29 insertions(+), 5 deletions(-)

diff --git a/.gitea/workflows/cms-content-validation.yml b/.gitea/workflows/cms-content-validation.yml
index 4a1dfad..d05f34f 100644
--- a/.gitea/workflows/cms-content-validation.yml
+++ b/.gitea/workflows/cms-content-validation.yml
@@ -20,8 +20,10 @@ jobs:
         uses: https://github.com/actions/setup-node@v4
         with:
           node-version: 22
+          cache: npm
+          cache-dependency-path: package-lock.json
       - name: Install locked dependencies
-        run: npm ci
+        run: npm ci --prefer-offline --no-audit --no-fund
       - name: Verify Decap configuration and content boundaries
         run: npm run verify:cms
       - name: Build primary site
diff --git a/.gitea/workflows/deploy-blog.yml b/.gitea/workflows/deploy-blog.yml
index 8cfb55f..51c11de 100644
--- a/.gitea/workflows/deploy-blog.yml
+++ b/.gitea/workflows/deploy-blog.yml
@@ -33,8 +33,10 @@ jobs:
         uses: https://github.com/actions/setup-node@v4
         with:
           node-version: 22
+          cache: npm
+          cache-dependency-path: package-lock.json
       - name: Install locked dependencies
-        run: npm ci
+        run: npm ci --prefer-offline --no-audit --no-fund
       - name: Validate and build selected site
         run: npm run build:site
       - name: Verify selected output
diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
index c5d57ae..91cc1b9 100644
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -33,8 +33,10 @@ jobs:
         uses: https://github.com/actions/setup-node@v4
         with:
           node-version: 22
+          cache: npm
+          cache-dependency-path: package-lock.json
       - name: Install locked dependencies
-        run: npm ci
+        run: npm ci --prefer-offline --no-audit --no-fund
       - name: Validate and build selected site
         run: npm run build:site
       - name: Verify selected output
diff --git a/.gitea/workflows/production-blog.yml b/.gitea/workflows/production-blog.yml
index 97df055..d015bf0 100644
--- a/.gitea/workflows/production-blog.yml
+++ b/.gitea/workflows/production-blog.yml
@@ -34,8 +34,10 @@ jobs:
         uses: https://github.com/actions/setup-node@v4
         with:
           node-version: 22
+          cache: npm
+          cache-dependency-path: package-lock.json
       - name: Install locked dependencies
-        run: npm ci
+        run: npm ci --prefer-offline --no-audit --no-fund
       - name: Validate and build production blog
         run: npm run build:site
       - name: Verify production blog output
diff --git a/.gitea/workflows/production-candidate.yml b/.gitea/workflows/production-candidate.yml
index 80db176..2a773d8 100644
--- a/.gitea/workflows/production-candidate.yml
+++ b/.gitea/workflows/production-candidate.yml
@@ -34,8 +34,10 @@ jobs:
         uses: https://github.com/actions/setup-node@v4
         with:
           node-version: 22
+          cache: npm
+          cache-dependency-path: package-lock.json
       - name: Install locked dependencies
-        run: npm ci
+        run: npm ci --prefer-offline --no-audit --no-fund
       - name: Validate and build production site
         run: npm run build:site
       - name: Verify production output
diff --git a/docs/decap-cms-pilot.md b/docs/decap-cms-pilot.md
index 85b140d..2c86a90 100644
--- a/docs/decap-cms-pilot.md
+++ b/docs/decap-cms-pilot.md
@@ -81,6 +81,9 @@ the pilot:
 - The existing branch preview workflows remain in place. Local output checks
   now prove preview robots rules and page metadata stay no-index and that the
   admin response has a no-index header rule.
+- Validation, preview, and production workflows cache npm's download store by
+  `package-lock.json` while retaining clean `npm ci` installs. Warm runner jobs
+  avoid repeatedly downloading the same dependency tarballs.
 
 The pilot dependencies are active: the public client ID, exact-origin CORS
 policy, `cms-pilot` branch, and both protection rules have been verified.
diff --git a/scripts/verify-decap.mjs b/scripts/verify-decap.mjs
index 7471685..d50b167 100644
--- a/scripts/verify-decap.mjs
+++ b/scripts/verify-decap.mjs
@@ -219,5 +219,16 @@ assert(!workflowText.includes('secrets.'), 'CMS pull-request validation must rem
 for (const command of ['npm run verify:cms', 'SITE_KEY=www npm run build:site', 'SITE_KEY=www npm run verify:build', 'SITE_KEY=blog npm run build:site', 'SITE_KEY=blog npm run verify:build']) {
   assert(workflowText.includes(command), `Validation workflow is missing: ${command}`);
 }
+for (const path of [
+  '.gitea/workflows/cms-content-validation.yml',
+  '.gitea/workflows/deploy.yml',
+  '.gitea/workflows/deploy-blog.yml',
+  '.gitea/workflows/production-candidate.yml',
+  '.gitea/workflows/production-blog.yml',
+]) {
+  const text = await readFile(path, 'utf8');
+  assert(/cache:\s*npm/.test(text) && /cache-dependency-path:\s*package-lock\.json/.test(text), `${path} must cache npm downloads by package-lock.json.`);
+  assert(text.includes('npm ci --prefer-offline --no-audit --no-fund'), `${path} must retain a clean lockfile install while preferring the cache.`);
+}
 
 console.log('Verified Decap backend, four content contracts, fixed page images, bounded media, admin pin, and stable PR status context.');