[CDX-610] fix react-compat ci failing

[niizom]

Pull Request Checklist

Before you submit a pull request, please make sure you have to following:

• I have added or updated TypeScript types for my changes, ensuring they are compatible with the existing codebase.
• I have added JSDoc comments to my TypeScript definitions for improved documentation.
• I have added tests that prove my fix is effective or that my feature works.
• I have added any necessary documentation (if appropriate).
• I have made sure my PR is up-to-date with the main branch.

PR Type

What kind of change does this PR introduce?

• Bugfix
• Feature
• Code style update (formatting, local variables)
• Refactoring (no functional changes, no API changes)
• Documentation content changes
• TypeScript type definitions update
• Other. Added a fix for failing react-compat test

[constructor-claude-bedrock]

Code Review

This PR fixes the react-compat CI workflow by switching from npm ci to npm install --package-lock=false, correctly addressing the root cause: npm ci fails when the local tarball dependency is regenerated on each CI run and no longer matches the committed lock file hash.

Inline comments: 1 discussion added

Overall Assessment: ⚠️ Needs Work

[constructor-claude-bedrock]

Important Issue: Switching to npm install --package-lock=false resolves the immediate npm ci failure, but it fully bypasses lock-file pinning for all transitive dependencies (not just the local tarball). This means every CI run resolves the latest versions of all deps from the registry, which can introduce silent breakages from transitive dependency upgrades.

A more precise fix would be to use npm install --no-audit --no-fund (without --package-lock=false) and ensure the fixture package-lock.json files do not commit a resolved entry for the local tarball path. Alternatively, you can keep --package-lock=false but add a --prefer-offline flag and a caching step so at least the registry packages are stable between runs.

If the intent is specifically to avoid npm ci failing due to the regenerated tarball hash, consider using npm ci --ignore-scripts combined with a separate npm install <local-tarball> step, or patching the lock file before running npm ci (e.g., npm install --package-lock-only to regenerate the lock file before npm ci).

The current change is pragmatic and unblocks CI, but the lack of lock-file enforcement for transitive deps reduces reproducibility for a test matrix that exists specifically to catch subtle compatibility issues.

[niizom]

Good point. But this is not an issue here cause we are using exact versions of a libraries so everything will be fine

[Copilot]

Pull request overview

Adjusts the React compatibility GitHub Actions matrix workflow to avoid fixture dependency installation failures when testing against a locally packed @constructor-io/constructorio-ui-components tarball.

Changes:

• Switches fixture dependency installation from npm ci to npm install in the react-compat workflow.
• Adds a flag to disable lockfile usage during fixture installs.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[niizom]

npm install still reads the lock file and enforces its integrity hashes. So it fails with the same EINTEGRITY error as npm ci when the tarball hash doesn't match.

[Mudaafi]

good find!