[kojiwakayama]

Summary

Main's CI/CD run has failed the SonarQube Cloud quality gate on every push since 6 Nov: new-code Security Rating is C (required A). The two findings are rule S6505 on the publication jobs' npm install --global "npm@${NPM_CLI_VERSION}" (cicd.yml lines 1667 and 1890). Both now pass --ignore-scripts; the npm package has no install scripts that the CLI needs.

Tests

• tests/integration/ci/registry-release-workflow.test.ts pins the new step command and passes.

[chatgpt-codex-connector]

Codex Review Summary: ✅ Completed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-07T08:56:17.224174Z	d494861	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

📦 Client bundle boundary

Entrypoint	Modules	Source size	Server leaks
src/index.client.ts	66	366 KiB	✅ 0
src/react/components/Head.tsx	5	74 KiB	✅ 0
src/react/router/index.tsx	5	74 KiB	✅ 0
src/react/context/index.tsx	5	74 KiB	✅ 0
src/react/fonts/index.ts	6	81 KiB	✅ 0
src/react/components/ui/index.ts	111	717 KiB	✅ 0
src/react/components/ui/adapter/contract.ts	1	18 KiB	✅ 0
src/react/components/ui/icons/index.ts	3	17 KiB	✅ 0
src/chat/index.ts	305	2046 KiB	✅ 0
src/chat/ag-ui.ts	61	459 KiB	✅ 0
src/chat/protocol.ts	1	11 KiB	✅ 0
src/chat/types.ts	46	246 KiB	✅ 0
src/chat/message-prep.ts	68	517 KiB	✅ 0
src/markdown/index.ts	6	30 KiB	✅ 0
src/mdx/index.ts	2	2 KiB	✅ 0
src/agent/identity-contracts.ts	1	3 KiB	✅ 0
src/schemas/index.ts	43	220 KiB	✅ 0
src/platform/env.ts	5	53 KiB	✅ 0
src/workflow/claude-code/react/index.ts	9	91 KiB	✅ 0
src/events/index.ts	31	567 KiB	✅ 0
src/events/ag-ui/public.ts	30	561 KiB	✅ 0
src/run-events/index.ts	54	321 KiB	✅ 0

A server module in a client graph aborts hydration in the browser. New leaks fail CI; known leaks are tracked in scripts/lint/client-bundle-baseline.json to burn down.

[kwakayama]

Score: 93/100. Small CI hardening change that clears the SonarQube S6505 findings, with the test pin updated to match.

• Strength: Both publication-job npm install --global steps (RC and release) get --ignore-scripts. No site is left inconsistent in the diff.
• Strength: The workflow test in registry-release-workflow.test.ts pins the exact new command, so a regression is caught.
• Strength: The diff is minimal (3 additions, 3 deletions) and the PR description explains the cause and the rationale.
• Minor concern: The claim that the npm package has no install scripts the CLI needs is not backed in the description. The Pin npm CLI steps run before publish, so confirm the next RC publish run still succeeds. The test only checks the string, not the behavior.
• Minor suggestion: Run rg "npm install --global" .github to ensure no other workflow or composite action has the same S6505 pattern.

I did not run the tests locally. I reviewed the diff only.

---

Generated by Claude Code

[github-actions]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Breezy!

Reviewed commit: d49486184a

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud