ci(openshell): enable trusted SDK package reads

.github/actions/ci-build-typecheck/action.yaml

@@ -18,6 +18,8 @@ runs:
 
     - name: Install dependencies
       shell: bash
+      env:
+        NODE_AUTH_TOKEN: ${{ github.event_name == 'push' && github.token || '' }}
       run: bash "$GITHUB_ACTION_PATH/../ci-install-dependencies.sh"
 
     - name: Build TypeScript plugin

.github/actions/ci-cli-coverage-merge/action.yaml

@@ -39,7 +39,9 @@ runs:
 
     - name: Install dependencies
       shell: bash
-      run: npm install --ignore-scripts
+      env:
+        NODE_AUTH_TOKEN: ${{ github.event_name == 'push' && github.token || '' }}
+      run: bash "$GITHUB_ACTION_PATH/../ci-install-dependencies.sh"
 
     - name: Download compiled CLI artifact
       uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1

.github/actions/ci-cli-coverage-shard/action.yaml

@@ -101,6 +101,8 @@ runs:
 
     - name: Install dependencies
       shell: bash
+      env:
+        NODE_AUTH_TOKEN: ${{ github.event_name == 'push' && github.token || '' }}
       run: bash "$GITHUB_ACTION_PATH/../ci-install-dependencies.sh"
 
     - name: Validate changed live E2E mock parity

.github/actions/ci-install-dependencies.sh

@@ -4,5 +4,57 @@
 
 set -euo pipefail
 
-npm ci --ignore-scripts
-npm --prefix nemoclaw ci --ignore-scripts
+candidate_npmrc="$(find . -path './.git' -prune -o -name .npmrc -print -quit)"
+if [ -n "$candidate_npmrc" ]; then
+  echo "Candidate repository npm configuration is not allowed during trusted dependency installation." >&2
+  exit 1
+fi
+
+for shrinkwrap in npm-shrinkwrap.json nemoclaw/npm-shrinkwrap.json; do
+  if [ -e "$shrinkwrap" ]; then
+    echo "Candidate npm shrinkwrap files are not allowed during trusted dependency installation." >&2
+    exit 1
+  fi
+done
+
+event_name="${GITHUB_EVENT_NAME:-local}"
+package_mode="registry"
+if [ "$event_name" = "pull_request" ]; then
+  package_mode="artifact"
+  if [ -n "${NODE_AUTH_TOKEN:-}" ]; then
+    echo "Pull request dependency installation must not receive a package credential." >&2
+    exit 1
+  fi
+fi
+
+target_root="$(pwd -P)"
+trusted_root="$(cd "$(dirname "$0")/../.." && pwd -P)"
+npm_cache="${NPM_CONFIG_CACHE:-${RUNNER_TEMP:-$target_root/.ci-cache}/npm}"
+mkdir -p "$npm_cache"
+
+NEMOCLAW_CI_NPM_CACHE="$npm_cache" \
+  NEMOCLAW_CI_NPM_PACKAGE_MODE="$package_mode" \
+  NEMOCLAW_CI_TARGET_ROOT="$target_root" \
+  NEMOCLAW_OPEN_SHELL_SDK_ARTIFACT_DIRECTORY="${RUNNER_TEMP:-$target_root/.ci-artifacts}/openshell-sdk" \
+  node --experimental-strip-types "$trusted_root/scripts/checks/prepare-ci-npm-install.mts"
+
+trusted_npmrc=""
+cleanup() {
+  if [ -n "$trusted_npmrc" ]; then
+    rm -f "$trusted_npmrc"
+  fi
+}
+trap cleanup EXIT
+
+if [ "$package_mode" = "registry" ] && [ -n "${NODE_AUTH_TOKEN:-}" ]; then
+  trusted_npmrc="${RUNNER_TEMP:-$target_root/.ci-cache}/trusted-npmrc"
+  mkdir -p "$(dirname "$trusted_npmrc")"
+  umask 077
+  printf '%s\n' \
+    '@nvidia:registry=https://npm.pkg.github.com' \
+    "//npm.pkg.github.com/:_authToken=\${NODE_AUTH_TOKEN}" >"$trusted_npmrc"
+  export NPM_CONFIG_USERCONFIG="$trusted_npmrc"
+fi
+
+npm ci --ignore-scripts --prefer-offline --cache "$npm_cache"
+npm --prefix nemoclaw ci --ignore-scripts --prefer-offline --cache "$npm_cache"

.github/actions/ci-installer-integration/action.yaml

@@ -18,6 +18,8 @@ runs:
 
     - name: Install dependencies
       shell: bash
+      env:
+        NODE_AUTH_TOKEN: ${{ github.event_name == 'push' && github.token || '' }}
       run: bash "$GITHUB_ACTION_PATH/../ci-install-dependencies.sh"
 
     - name: Build installer integration artifacts

.github/actions/ci-plugin-coverage/action.yaml

@@ -18,6 +18,8 @@ runs:
 
     - name: Install dependencies
       shell: bash
+      env:
+        NODE_AUTH_TOKEN: ${{ github.event_name == 'push' && github.token || '' }}
       run: bash "$GITHUB_ACTION_PATH/../ci-install-dependencies.sh"
 
     - name: Run plugin coverage

.github/actions/ci-static-checks/action.yaml

@@ -12,6 +12,9 @@ runs:
       with:
         node-version: "22"
         cache: npm
+        cache-dependency-path: |
+          package-lock.json
+          nemoclaw/package-lock.json
 
     - name: Install base-trusted createRequire verifier dependencies
       shell: bash
@@ -33,13 +36,11 @@ runs:
         [ "$HADOLINT_SHA256" = "$ACTUAL" ] || { echo "::error::hadolint checksum mismatch"; exit 1; }
         chmod +x /usr/local/bin/hadolint
 
-    - name: Validate sandbox payload lockfile
-      shell: bash
-      run: npm --prefix nemoclaw ci --ignore-scripts --dry-run
-
     - name: Install dependencies
       shell: bash
-      run: npm install --ignore-scripts
+      env:
+        NODE_AUTH_TOKEN: ${{ github.event_name == 'push' && github.token || '' }}
+      run: bash "$GITHUB_ACTION_PATH/../ci-install-dependencies.sh"
 
     - name: Verify reviewed runtime bundles
       shell: bash

.github/workflows/main.yaml

@@ -23,6 +23,9 @@ concurrency:
 jobs:
   static-checks:
     name: Static Checks
+    permissions:
+      contents: read
+      packages: read
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
@@ -36,6 +39,9 @@ jobs:
 
   build-typecheck:
     name: Build and type-check
+    permissions:
+      contents: read
+      packages: read
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
@@ -49,6 +55,9 @@ jobs:
 
   installer-integration:
     name: Installer Integration
+    permissions:
+      contents: read
+      packages: read
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
@@ -146,6 +155,9 @@ jobs:
 
   cli-test-shards:
     name: CLI / Shard ${{ matrix.shard }}
+    permissions:
+      contents: read
+      packages: read
     runs-on: ubuntu-24.04
     # Keep the post-merge budget aligned with pull requests so the same
     # duration-weighted coverage roster can finish and upload its artifacts.
@@ -175,6 +187,7 @@ jobs:
       actions: read
       code-quality: write
       contents: read
+      packages: read
       pull-requests: read
     runs-on: ubuntu-latest
     timeout-minutes: 10
@@ -250,6 +263,7 @@ jobs:
     permissions:
       code-quality: write
       contents: read
+      packages: read
       pull-requests: read
     runs-on: ubuntu-latest
     timeout-minutes: 10

.github/workflows/openshell-sdk-package-pr.yaml

@@ -0,0 +1,68 @@
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
+name: Security / Package OpenShell SDK for PR
+
+run-name: "OpenShell SDK PR #${{ github.event.pull_request.number }} head ${{ github.event.pull_request.head.sha }} base ${{ github.event.pull_request.base.sha }}"
+
+# This workflow is loaded from the pull request base branch. It must never
+# check out or execute pull request content because its token can read packages.
+on:
+  pull_request_target:
+    types: [opened, synchronize, reopened, edited]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: openshell-sdk-package-${{ github.event.pull_request.number }}-${{ github.event.pull_request.head.sha }}
+  cancel-in-progress: true
+
+jobs:
+  package-openshell-sdk:
+    if: ${{ github.event.pull_request.head.repo.full_name == github.repository && (github.event.action != 'edited' || github.event.changes.base != null) }}
+    permissions:
+      contents: read
+      packages: read
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: Checkout base-controlled package verifier
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ github.event.pull_request.base.sha }}
+          persist-credentials: false
+          sparse-checkout: |
+            ci/reviewed-npm-audit.json
+            scripts/audit-reviewed-npm-graph.mts
+            scripts/checks/package-openshell-sdk-for-pr.mts
+            scripts/lib/openclaw-npm-remediation.mts
+            scripts/lib/reviewed-npm-archive.mts
+            scripts/lib/reviewed-npm-audit.mts
+          sparse-checkout-cone-mode: false
+
+      - name: Setup Node.js for reviewed package download
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: "22"
+          registry-url: https://npm.pkg.github.com
+          scope: "@nvidia"
+
+      - name: Download and verify exact OpenShell SDK package
+        id: package
+        env:
+          NEMOCLAW_OPEN_SHELL_SDK_OUTPUT_DIRECTORY: ${{ runner.temp }}/openshell-sdk
+          NODE_AUTH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          artifact_path="$(node --experimental-strip-types scripts/checks/package-openshell-sdk-for-pr.mts)"
+          [ -n "$artifact_path" ]
+          printf 'artifact_path=%s\n' "$artifact_path" >> "$GITHUB_OUTPUT"
+
+      - name: Upload verified OpenShell SDK archive
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: openshell-sdk-${{ github.event.pull_request.head.sha }}
+          path: ${{ steps.package.outputs.artifact_path }}
+          if-no-files-found: error
+          retention-days: 1