From 12531a06f89478eb41ab1d6c863e17b044e9d143 Mon Sep 17 00:00:00 2001
From: Sehoon Shon <sshon@google.com>
Date: Fri, 30 Jan 2026 14:42:29 -0500
Subject: [PATCH] run npx pointing to the specific commit SHA (#17970)

Co-authored-by: Bryan Morgan <bryanmorgan@google.com>
---
 .github/workflows/ci.yml | 49 +++++++++++++++++++++++++---------------
 1 file changed, 31 insertions(+), 18 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 7b6b850f71..a0811306be 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -179,12 +179,16 @@ jobs:
 
       - name: 'Smoke test npx installation'
         run: |
-          # Create a temporary directory to avoid picking up local node_modules
-          mkdir -p ../npx-test
-          cd ../npx-test
-          # Run npx pointing to the checkout directory. This simulates a user
-          # installing the package from a git reference.
-          npx ${{ github.workspace }} --version
+          # 1. Package the project into a tarball
+          TARBALL=$(npm pack | tail -n 1)
+
+          # 2. Move to a fresh directory for isolation
+          mkdir -p ../smoke-test-dir
+          mv "$TARBALL" ../smoke-test-dir/
+          cd ../smoke-test-dir
+
+          # 3. Run npx from the tarball
+          npx "./$TARBALL" --version
 
       - name: 'Wait for file system sync'
         run: 'sleep 2'
@@ -263,12 +267,16 @@ jobs:
 
       - name: 'Smoke test npx installation'
         run: |
-          # Create a temporary directory to avoid picking up local node_modules
-          mkdir -p ../npx-test
-          cd ../npx-test
-          # Run npx pointing to the checkout directory. This simulates a user
-          # installing the package from a git reference.
-          npx ${{ github.workspace }} --version
+          # 1. Package the project into a tarball
+          TARBALL=$(npm pack | tail -n 1)
+
+          # 2. Move to a fresh directory for isolation
+          mkdir -p ../smoke-test-dir
+          mv "$TARBALL" ../smoke-test-dir/
+          cd ../smoke-test-dir
+
+          # 3. Run npx from the tarball
+          npx "./$TARBALL" --version
 
       - name: 'Wait for file system sync'
         run: 'sleep 2'
@@ -416,12 +424,17 @@ jobs:
 
       - name: 'Smoke test npx installation'
         run: |
-          # Create a temporary directory to avoid picking up local node_modules
-          New-Item -ItemType Directory -Force -Path ../npx-test
-          Set-Location ../npx-test
-          # Run npx pointing to the checkout directory. This simulates a user
-          # installing the package from a git reference.
-          npx ${{ github.workspace }} --version
+          # 1. Package the project into a tarball
+          $PACK_OUTPUT = npm pack
+          $TARBALL = $PACK_OUTPUT[-1]
+
+          # 2. Move to a fresh directory for isolation
+          New-Item -ItemType Directory -Force -Path ../smoke-test-dir
+          Move-Item $TARBALL ../smoke-test-dir/
+          Set-Location ../smoke-test-dir
+
+          # 3. Run npx from the tarball
+          npx "./$TARBALL" --version
         shell: 'pwsh'
 
   ci: