Cache npm downloads in Gitea workflows

.gitea/workflows/cms-content-validation.yml

@@ -20,8 +20,10 @@ jobs:
         uses: https://github.com/actions/setup-node@v4
         with:
           node-version: 22
+          cache: npm
+          cache-dependency-path: package-lock.json
       - name: Install locked dependencies
-        run: npm ci
+        run: npm ci --prefer-offline --no-audit --no-fund
       - name: Verify Decap configuration and content boundaries
         run: npm run verify:cms
       - name: Build primary site

.gitea/workflows/deploy-blog.yml

@@ -33,8 +33,10 @@ jobs:
         uses: https://github.com/actions/setup-node@v4
         with:
           node-version: 22
+          cache: npm
+          cache-dependency-path: package-lock.json
       - name: Install locked dependencies
-        run: npm ci
+        run: npm ci --prefer-offline --no-audit --no-fund
       - name: Validate and build selected site
         run: npm run build:site
       - name: Verify selected output

.gitea/workflows/deploy.yml

@@ -33,8 +33,10 @@ jobs:
         uses: https://github.com/actions/setup-node@v4
         with:
           node-version: 22
+          cache: npm
+          cache-dependency-path: package-lock.json
       - name: Install locked dependencies
-        run: npm ci
+        run: npm ci --prefer-offline --no-audit --no-fund
       - name: Validate and build selected site
         run: npm run build:site
       - name: Verify selected output

.gitea/workflows/production-blog.yml

@@ -34,8 +34,10 @@ jobs:
         uses: https://github.com/actions/setup-node@v4
         with:
           node-version: 22
+          cache: npm
+          cache-dependency-path: package-lock.json
       - name: Install locked dependencies
-        run: npm ci
+        run: npm ci --prefer-offline --no-audit --no-fund
       - name: Validate and build production blog
         run: npm run build:site
       - name: Verify production blog output

.gitea/workflows/production-candidate.yml

@@ -34,8 +34,10 @@ jobs:
         uses: https://github.com/actions/setup-node@v4
         with:
           node-version: 22
+          cache: npm
+          cache-dependency-path: package-lock.json
       - name: Install locked dependencies
-        run: npm ci
+        run: npm ci --prefer-offline --no-audit --no-fund
       - name: Validate and build production site
         run: npm run build:site
       - name: Verify production output

docs/decap-cms-pilot.md

@@ -81,6 +81,9 @@ the pilot:
 - The existing branch preview workflows remain in place. Local output checks
   now prove preview robots rules and page metadata stay no-index and that the
   admin response has a no-index header rule.
+- Validation, preview, and production workflows cache npm's download store by
+  `package-lock.json` while retaining clean `npm ci` installs. Warm runner jobs
+  avoid repeatedly downloading the same dependency tarballs.
 
 The pilot dependencies are active: the public client ID, exact-origin CORS
 policy, `cms-pilot` branch, and both protection rules have been verified.

scripts/verify-decap.mjs

@@ -219,5 +219,16 @@ assert(!workflowText.includes('secrets.'), 'CMS pull-request validation must rem
 for (const command of ['npm run verify:cms', 'SITE_KEY=www npm run build:site', 'SITE_KEY=www npm run verify:build', 'SITE_KEY=blog npm run build:site', 'SITE_KEY=blog npm run verify:build']) {
   assert(workflowText.includes(command), `Validation workflow is missing: ${command}`);
 }
+for (const path of [
+  '.gitea/workflows/cms-content-validation.yml',
+  '.gitea/workflows/deploy.yml',
+  '.gitea/workflows/deploy-blog.yml',
+  '.gitea/workflows/production-candidate.yml',
+  '.gitea/workflows/production-blog.yml',
+]) {
+  const text = await readFile(path, 'utf8');
+  assert(/cache:\s*npm/.test(text) && /cache-dependency-path:\s*package-lock\.json/.test(text), `${path} must cache npm downloads by package-lock.json.`);
+  assert(text.includes('npm ci --prefer-offline --no-audit --no-fund'), `${path} must retain a clean lockfile install while preferring the cache.`);
+}
 
 console.log('Verified Decap backend, four content contracts, fixed page images, bounded media, admin pin, and stable PR status context.');