Use npm ci in issue automation workflows

[Sean McManus (sean-mcmanus)]

Summary

Use npm ci --omit=dev in the 19 scheduled issue-automation workflows so their production dependencies are installed exactly from .github/actions/package-lock.json.

Why this helps

These workflows run on a schedule and automatically label, comment on, close, reopen, or lock issues. Their behavior depends on the JavaScript packages installed before each run, so the install should be repeatable for a given repository commit.

npm install --production can reconcile differences between package.json and package-lock.json while the workflow is running. That makes an accidental mismatch less obvious and can cause the workflow to run with a dependency graph other than the one recorded in the committed lockfile.

npm ci --omit=dev instead:

• requires package.json and package-lock.json to agree, failing the job when they do not;
• installs the production dependency versions recorded in the lockfile;
• starts from a clean node_modules directory; and
• leaves the package manifest and lockfile unchanged.

This makes repeated scheduled runs from the same commit more predictable and turns dependency drift into a visible failure instead of silently changing what the automation runs. That is especially useful for workflows that act on user-facing issues without someone manually reviewing every scheduled execution.

This carries forward the supported deterministic dependency-restoration portion of #14701.

This PR was investigated and created by GitHub Copilot in VS Code. Any message starting with ✨Copilot: was sent by Copilot.

Validation

• Ran npm ci --omit=dev from a clean .github/actions directory with Node 24.18.1 and npm 11.16.0.
• Confirmed the install resolved the complete production graph and left package-lock.json byte-identical.
• Confirmed npm ci --omit=dev rejects a temporary package.json/package-lock.json mismatch.
• Syntax-checked all four action entry points with Node 24.
• Confirmed YAML diagnostics and git diff --check are clean.

[Copilot]

Pull request overview

Updates scheduled issue-automation workflows to restore production dependencies deterministically from .github/actions/package-lock.json.

Changes:

• Replaces npm install --production with npm ci --omit=dev.
• Applies the change consistently across all 19 workflows.

Reviewed changes

Copilot reviewed 19 out of 19 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
.github/workflows/question-closer.yml	Uses locked production dependencies.
.github/workflows/question-closer-debugger.yml	Uses locked production dependencies.
.github/workflows/more-info-needed-closer.yml	Uses locked production dependencies.
.github/workflows/more-info-needed-closer-debugger.yml	Uses locked production dependencies.
.github/workflows/locker.yml	Uses locked production dependencies.
.github/workflows/investigate-costing-closer-debugger.yml	Uses locked production dependencies.
.github/workflows/investigate-closer-debugger.yml	Uses locked production dependencies.
.github/workflows/feature-request-reopener.yml	Uses locked production dependencies.
.github/workflows/feature-request-debugger.yml	Uses locked production dependencies.
.github/workflows/feature-request-closer-triage.yml	Uses locked production dependencies.
.github/workflows/feature-request-closer-no-milestone.yml	Uses locked production dependencies.
.github/workflows/external-closer-debugger.yml	Uses locked production dependencies.
.github/workflows/enhancement-reopener.yml	Uses locked production dependencies.
.github/workflows/enhancement-closer-triage.yml	Uses locked production dependencies.
.github/workflows/enhancement-closer-no-milestone.yml	Uses locked production dependencies.
.github/workflows/duplicate-closer.yml	Uses locked production dependencies.
.github/workflows/by-design-closer.yml	Uses locked production dependencies.
.github/workflows/by-design-closer-debugger.yml	Uses locked production dependencies.
.github/workflows/bug-debugger.yml	Uses locked production dependencies.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.