[diegosouzapw]

Repository-controlled root dependency installs now pass ONNXRUNTIME_NODE_INSTALL=skip directly to npm, so ONNX Runtime's skip decision no longer depends on npm forwarding the custom project-config key. The shared retry action and 14 direct install steps receive step-scoped env; the action itself joins the existing dependency cache hash inputs. Local POSIX and PowerShell usage is documented next to the action.

Closes #16225

The legacy .npmrc key remains for compatibility, so its warning can remain. Existing cache inputs, retries, exit propagation, native verification, workflow permissions/triggers and Electron env are preserved. Docker's checkout install already uses --ignore-scripts and stays unchanged. Published-package consumers, separate containers, SSH deployments and tarball smoke tests are outside this checkout environment guarantee.

Validation

Validated locally against 1d5128f55f3f01e1310caaa1d58046c6f15ebf62, using Node 24.21.0/npm 11.15.0, synthetic directories and offline guards:

• Immutable 29-case configuration fixture: 12 PASS / 17 FAIL before the changes → 29/29 afterward. This exercises the actual ONNX 1.30.0 flag parser, a real local npm lifecycle and the action shell with only the install/network boundary replaced. No application install or CUDA download is performed.
• Final direct-node invocation passes 29/29 without npm_execpath, with explicit PATH fallback, pinned npm-version check and identical Node runtime in the lifecycle child. No skips, cancellations or network denials on Linux; Windows execution remains unverified and the Bash-specific case is platform-limited.
• Related 21-file selection passes 235/235. Its 20 unchanged siblings and final focused rerun cover the action's retry/cache/native-verification contracts, the changed workflows and ONNX dependency-shape controls. These overlapping counts are not additive.
• Final mutant control passes 29/29; removing action env, one direct-step env or the action cache input produces the expected 2, 1 and 1 failures. YAML structural comparison proves all other configuration preserved. Cache evidence verifies effective arguments and changed input digest, not a hosted cache hit/miss.
• Focused lint, Prettier, focal 15/80/15, file-size, discovery, changelog and actionlint pass. Docs-all exits 0 but two external CLI-version lookups were blocked; those discovery results are not claimed as verified. Core (57.37 s), dashboard (207.23 s), cyclomatic complexity (158.93 s) and cognitive complexity (11.23 s) pass on the final freeze. Dashboard retains 195 diagnostics within baseline; the ratchets report 3032/3218 and 1390/1437 respectively.

The separate typecheck:noimplicit:core gate remains exit 2, with four TS7053 diagnostics in open-sse/utils/proxyDispatcherCache.ts (173/175) and src/lib/db/databaseSettings.ts (302/303). Its full TypeScript 6.0.3 input inventory contains 1,627 versioned source inputs plus 11 tracked resolution metadata files, all byte-identical to base 1d512; 826 dependency inputs come from the same retained dependency tree. No generated/untracked input or changed PR path enters that project. This is an inherited-by-input-equivalence attribution accepted during review, not a new compiler execution on a pristine base, and not a passing strict gate. No baseline was relaxed.

The initial Docker-control selector mistake and an unsuccessful intermediate fixture-edit attempt remain recorded separately from the valid RED/GREEN pairs. No startup crash, 300 MB payload, future npm release behavior, full coverage, build or hosted CI result was reproduced or claimed.

Historical base-red context: #15306 remains open. Its six recorded release-green outcomes are unit-suite timeout, Vitest MCP audit shutdown failure, integration timeout, package-artifact timeout, downstream tarball smoke skipped because its artifact was absent, and an AI-attribution Git-range failure. Those outcomes were not reproduced anew here; the downstream skip is not an independent executed test failure. This PR does not claim the full release is green.

[github-actions]

CI Coverage Report

• Coverage job: skipped
• PR test policy: success

Coverage artifact was not available for this run.

[diegosouzapw]

Fechando esta PR para esvaziar a fila aberta. A branch feat/16225-onnx-install-env-1010 não é apagada. Se ainda precisar entrar, comente aqui que reabrimos.

[diegosouzapw]

Reabrindo. O fechamento foi um engano; esta PR volta para a fila de merge. A branch continua no lugar.