ci: guard against silently merge-corrupted lockfiles

↗ view on GitHub · QA Runner · 2026-07-22 · e25c2637

PR #233's CI failed with "npm ci can only install with an existing
package-lock.json" even though the file existed: a "Merge branch 'main'"
commit had auto-merged backend/package.json and package-lock.json into
invalid JSON with no conflict raised, and npm reports an unparseable
lockfile as if it were missing.

Two guards: .gitattributes marks package-lock.json/bun.lock merge=binary so
concurrent lockfile changes surface as explicit conflicts (resolve by
regenerating, never hand-merging), and CI parse-checks package.json and the
lockfile before npm ci so any corruption that still lands fails with the
real reason.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Repository open-legal-products/mike
Author QA Runner <qa@local>
Authored
Parents 2ec89a7c
Stats 2 files changed , +20
Part of Guard lockfiles against silent merge corruption

Capture this commit into my fork

Download a Markdown prompt that tells Claude how to port this exact commit into your working tree. Run it via claude -p < capture-commit-e25c2637.md from inside the repo you want the change in.

⬇ Download capture-commit-e25c2637.md