fix(coverage): restore validated npm workspace lock owners

.github/workflows/rebuild-pr748-current-main.yml

@@ -0,0 +1,201 @@
+name: Rebuild PR 748 on current main
+
+on:
+  push:
+    branches:
+      - fix/npm-workspace-coverage-root-clean
+    paths:
+      - .github/workflows/rebuild-pr748-current-main.yml
+
+concurrency:
+  group: rebuild-pr748-current-main
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
+  PYTHONWARNINGS: error
+
+jobs:
+  rebuild:
+    if: >-
+      github.repository == 'ContextualWisdomLab/.github' &&
+      github.actor == 'seonghobae' &&
+      github.ref == 'refs/heads/fix/npm-workspace-coverage-root-clean'
+    permissions:
+      contents: write
+    runs-on: ubuntu-24.04
+    timeout-minutes: 60
+    steps:
+      - name: Harden runner
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        with:
+          egress-policy: audit
+
+      - name: Checkout exact trigger without persisted credentials
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ github.sha }}
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Apply reviewed resolver patch without regressing current toolchain
+        env:
+          REVIEWED_MAIN: f070c504c1cb06891b800d7ab0cf6ac7d3cf8eae
+        shell: bash --noprofile --norc -e -o pipefail {0}
+        run: |
+          test "$(git rev-parse HEAD)" = "$GITHUB_SHA"
+          git merge-base --is-ancestor "$REVIEWED_MAIN" HEAD
+          python3 -m py_compile scripts/ci/apply_pr748_current_main.py
+          python3 scripts/ci/apply_pr748_current_main.py
+          python3 - <<'PY'
+          from pathlib import Path
+
+          path = Path('.github/workflows/opencode-review-dispatch.yml')
+          workflow = path.read_text(encoding='utf-8')
+
+          package_anchor = (
+              '              r-cran-testthat \\\n'
+              '              rustc \\\n'
+          )
+          package_replacement = (
+              '              r-cran-testthat \\\n'
+              '              llvm-19 \\\n'
+              '              rustc \\\n'
+          )
+          if package_replacement not in workflow:
+              if workflow.count(package_anchor) != 1:
+                  raise SystemExit('LLVM package restoration anchor is not unique')
+              workflow = workflow.replace(package_anchor, package_replacement, 1)
+
+          tool_anchor = (
+              '            && rm -rf /var/lib/apt/lists/*\n'
+              '          RUN curl --proto \'=https\' --tlsv1.2 -fsSLo /tmp/node-linux-x64.tar.xz \\\n'
+          )
+          tool_replacement = (
+              '            && rm -rf /var/lib/apt/lists/*\n'
+              '          ENV LLVM_COV=/usr/bin/llvm-cov-19\n'
+              '          ENV LLVM_PROFDATA=/usr/bin/llvm-profdata-19\n'
+              '          RUN test -x "$LLVM_COV" && test -x "$LLVM_PROFDATA"\n'
+              '          RUN curl --proto \'=https\' --tlsv1.2 -fsSLo /tmp/node-linux-x64.tar.xz \\\n'
+          )
+          if tool_replacement not in workflow:
+              if workflow.count(tool_anchor) != 1:
+                  raise SystemExit('LLVM executable restoration anchor is not unique')
+              workflow = workflow.replace(tool_anchor, tool_replacement, 1)
+
+          llvm_package = workflow.index('              llvm-19 ' + chr(92))
+          llvm_check = workflow.index('RUN test -x "$LLVM_COV" && test -x "$LLVM_PROFDATA"')
+          cargo_llvm_cov = workflow.index(
+              'https://github.com/taiki-e/cargo-llvm-cov/releases/download/'
+          )
+          if not llvm_package < llvm_check < cargo_llvm_cov:
+              raise SystemExit('LLVM package/check ordering regressed')
+          path.write_text(workflow, encoding='utf-8')
+          PY
+          git add .github/workflows/opencode-review-dispatch.yml
+          git diff --cached --check
+
+      - name: Set up Python 3.14
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.14"
+          cache: pip
+          cache-dependency-path: requirements-opencode-review-ci-hashes.txt
+
+      - name: Install exact hash-locked central test dependencies
+        run: >-
+          python -m pip install --disable-pip-version-check --require-hashes
+          -r requirements-opencode-review-ci-hashes.txt
+
+      - name: Verify focused behavior and complete resolver coverage
+        shell: bash --noprofile --norc -e -o pipefail {0}
+        run: |
+          python -m coverage erase
+          python -m coverage run --branch -m pytest -q \
+            tests/test_npm_workspace_install_root.py \
+            tests/test_npm_workspace_install_root_hardening.py
+          python -m coverage report \
+            --include=scripts/ci/npm_workspace_install_root.py \
+            --fail-under=100 \
+            --show-missing
+          interrogate -vv --fail-under=100 scripts/ci/npm_workspace_install_root.py
+          python -m pytest -q tests/test_opencode_agent_contract.py
+          python -m compileall -q \
+            scripts/ci/npm_workspace_install_root.py \
+            tests/npm_workspace_test_support.py \
+            tests/test_npm_workspace_install_root.py \
+            tests/test_npm_workspace_install_root_hardening.py \
+            tests/test_opencode_agent_contract.py
+          ruff check \
+            scripts/ci/npm_workspace_install_root.py \
+            tests/npm_workspace_test_support.py \
+            tests/test_npm_workspace_install_root.py \
+            tests/test_npm_workspace_install_root_hardening.py \
+            tests/test_opencode_agent_contract.py
+
+      - name: Verify full central regression suite and workflow contract
+        shell: bash --noprofile --norc -e -o pipefail {0}
+        run: |
+          python -m pytest -q
+          python - <<'PY'
+          from pathlib import Path
+          import yaml
+
+          workflow_path = Path('.github/workflows/opencode-review-dispatch.yml')
+          workflow = workflow_path.read_text(encoding='utf-8')
+          yaml.safe_load(workflow)
+          required = (
+              'resolve_npm_package_root()',
+              'resolve_npm_install_root()',
+              'npm_workspace_install_root.py',
+              '--workspace "$npm_workspace_selector"',
+              'npm offline ci (workspace root), lifecycle hooks disabled',
+              '              llvm-19 ' + chr(92),
+              'ENV LLVM_COV=/usr/bin/llvm-cov-19',
+              'ENV LLVM_PROFDATA=/usr/bin/llvm-profdata-19',
+          )
+          missing = [fragment for fragment in required if fragment not in workflow]
+          if missing:
+              raise SystemExit(f'missing workflow contracts: {missing}')
+          PY
+          git diff --check
+
+      - name: Publish verified seven-file product-policy diff
+        env:
+          PUSH_TOKEN: ${{ github.token }}
+          TARGET_BRANCH: fix/npm-workspace-coverage-root-clean
+          EXPECTED_HEAD: ${{ github.sha }}
+          REVIEWED_MAIN: f070c504c1cb06891b800d7ab0cf6ac7d3cf8eae
+        shell: bash --noprofile --norc -e -o pipefail {0}
+        run: |
+          remote_head="$(git ls-remote origin "refs/heads/${TARGET_BRANCH}" | cut -f1)"
+          test "$remote_head" = "$EXPECTED_HEAD"
+          rm -f \
+            .coverage \
+            .github/workflows/rebuild-pr748-current-main.yml \
+            scripts/ci/apply_pr748_current_main.py
+          git add -A
+          git diff --cached --check
+          actual_files="$(git diff --cached --name-only "$REVIEWED_MAIN" | sort)"
+          expected_files="$(printf '%s\n' \
+            .github/workflows/opencode-review-dispatch.yml \
+            docs/doctoring/npm-workspace-lock-ownership.md \
+            scripts/ci/npm_workspace_install_root.py \
+            tests/npm_workspace_test_support.py \
+            tests/test_npm_workspace_install_root.py \
+            tests/test_npm_workspace_install_root_hardening.py \
+            tests/test_opencode_agent_contract.py | sort)"
+          test "$actual_files" = "$expected_files"
+          test ! -e .github/workflows/rebuild-pr748-current-main.yml
+          test ! -e scripts/ci/apply_pr748_current_main.py
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git commit -m "fix(coverage): restore validated npm workspace lock owners"
+          auth_header="$(printf 'x-access-token:%s' "$PUSH_TOKEN" | base64 | tr -d '\n')"
+          echo "::add-mask::$auth_header"
+          git -c http.extraheader="AUTHORIZATION: basic ${auth_header}" \
+            push --force-with-lease="refs/heads/${TARGET_BRANCH}:${EXPECTED_HEAD}" \
+            origin "HEAD:refs/heads/${TARGET_BRANCH}"