ci(security): enable trusted npm audit reuse

[cv]

Outcome

Trusted pull request audit jobs now restore reviewed npm audit evidence without triggering redundant install-time advisory requests in CI paths that already have explicit reviewed audit coverage.

Reason

PR #11029 landed the cache-aware trusted action, so its PR callers can now pass cache-directory safely. Ordinary npm installs in the same reviewed CI paths should not make separate best-effort advisory calls.

Related issues

Refs #11028

Changes

• Enable cache-directory for the trusted PR and managed-image reviewed-audit action callers.
• Disable npm's implicit install-time audit and funding requests in shared CI dependency installation and reviewed main/PR/managed-image workflows.
• Update workflow and installer contracts to protect cache input compatibility and no-audit install arguments.

Verification

• Contributor validation: Commit hooks and npm run validate:pr passed.
• Tests: Focused integration and E2E-support workflow tests: 130 passed. npm run typecheck:cli passed after npm run build:cli. npm run validate:pr passed.
• Broad gate: npm run validate:pr passed.
• Secrets review: The diff contains no secrets, API keys, or credentials

---

Signed-off-by: Carlos Villela cvillela@nvidia.com

Summary by CodeRabbit

• Chores
  • Updated automated dependency installation to skip npm audit checks and funding notices.
  • Added a temporary cache location for reviewed npm audit jobs.
• Tests
  • Updated workflow validation to verify the revised dependency installation and audit-cache settings.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 12f9ee04-2d7c-4ba5-afa5-9b8dc7ad7bb7

📥 Commits

Reviewing files that changed from the base of the PR and between c86529f and 0a3bea6.

📒 Files selected for processing (7)

• .github/actions/ci-install-dependencies.sh
• .github/workflows/main.yaml
• .github/workflows/managed-images.yaml
• .github/workflows/pr.yaml
• test/automation/pull-requests/pr-workflow-contract.test.ts
• test/inference/managed/managed-image-publication-workflow.test.ts
• test/repository/ci-install-dependencies.test.ts

Included review availability: Your plan provides up to 12 included reviews per hour; 10 remain after this review.

---

📝 Walkthrough

Walkthrough

Changes

The CI installer and workflow dependency steps now disable npm audits and funding notices. Reviewed npm audit jobs now use a temporary cache directory. Contract tests verify these options and paths.

CI npm controls

Layer / File(s)	Summary
Disable npm audit and funding operations .github/actions/ci-install-dependencies.sh, .github/workflows/main.yaml, .github/workflows/managed-images.yaml, .github/workflows/pr.yaml, test/automation/pull-requests/pr-workflow-contract.test.ts, test/inference/managed/managed-image-publication-workflow.test.ts, test/repository/ci-install-dependencies.test.ts	CI dependency installation commands pass --no-audit and --no-fund. Tests verify the updated commands.
Configure reviewed audit cache paths .github/workflows/managed-images.yaml, .github/workflows/pr.yaml, test/inference/managed/managed-image-publication-workflow.test.ts	Reviewed npm audit jobs use ${{ runner.temp }}/reviewed-npm-audit-cache. Tests verify the cache configuration.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to 0a3be

CI dependency installs no longer perform implicit npm audit or funding requests, while reviewed audit jobs use runner-temporary cache storage. The workflow and installer contracts are covered by updated tests, with no remaining merge-blocking risk identified.

Suggested reviewers: brandonpelfrey

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: reusing trusted npm audit evidence in CI workflows.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 4…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch ci/enable-pr-audit-cache

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

PR Review Advisor finished for commit 0a3bea6. Include the Advisor findings in the complete PR feedback collection. Verify and group valid findings before repair.

All previous runs