Prefer npm ci over install for security (#26601)

diff --git a/scripts/ui-assets.cmake b/scripts/ui-assets.cmake
index dc0417ea084b5c28d0974d943dcc47b2daaaaa0a..0c1c4de555a12cbc9414656c10440da90696765c 100644 (file)
--- a/scripts/ui-assets.cmake
+++ b/scripts/ui-assets.cmake
@@ -123,15 +123,15 @@ function(npm_build out_var)
     endif()
 
     if(need_install)
-        message(STATUS "UI: running npm install")
+        message(STATUS "UI: running npm ci")
         execute_process(
-            COMMAND ${NPM_EXECUTABLE} install
+            COMMAND ${NPM_EXECUTABLE} ci
             WORKING_DIRECTORY "${WORK_DIR}"
             RESULT_VARIABLE rc
             ERROR_VARIABLE  err
         )
         if(NOT rc EQUAL 0)
-            message(STATUS "UI: npm install failed (${rc})")
+            message(STATUS "UI: npm ci failed (${rc})")
             message(STATUS "  stderr: ${err}")
             return()
         endif()

diff --git a/tools/ui/README.md b/tools/ui/README.md
index 1b99ebbfe80631d8374f8003c4e4ef11dd804403..53b5925e2ceea7268fc41721d3510cebaa1997c9 100644 (file)
--- a/tools/ui/README.md
+++ b/tools/ui/README.md
@@ -89,7 +89,7 @@ Llama UI supports two server operation modes:
 
 ```bash
 cd tools/ui
-npm install
+npm ci
 ```
 
 ### 2. Start llama-server

diff --git a/tools/ui/scripts/dev.sh b/tools/ui/scripts/dev.sh
index 7e1d3c15e5bbfc2190a38a50ad44dea9c2a736f7..d14186630d96efa9bf69a8ed0dac32d22faf4666 100644 (file)
--- a/tools/ui/scripts/dev.sh
+++ b/tools/ui/scripts/dev.sh
@@ -14,7 +14,7 @@ cd ../../
 # Ensure node_modules are installed
 if [ ! -d "tools/ui/node_modules" ]; then
     echo "📦 Installing npm dependencies..."
-    cd tools/ui && npm install && cd ../../
+    cd tools/ui && npm ci && cd ../../
 fi
 
 # Check and install git hooks if missing

diff --git a/tools/ui/scripts/git-hooks/pre-commit.sh b/tools/ui/scripts/git-hooks/pre-commit.sh
index 208ef56fcd53f76b8c23da23d2efa3b08fb9a67b..31c23ed518785e22d9bbb70766d95263fb347725 100755 (executable)
--- a/tools/ui/scripts/git-hooks/pre-commit.sh
+++ b/tools/ui/scripts/git-hooks/pre-commit.sh
@@ -14,7 +14,7 @@ cd "$REPO_ROOT/tools/ui"
 
 # Check that node_modules exists
 if [ ! -d "node_modules" ]; then
-    echo "❌ node_modules not found. Run 'npm install' first."
+    echo "❌ node_modules not found. Run 'npm ci' first."
     exit 1
 fi
 

diff --git a/tools/ui/scripts/git-hooks/pre-push.sh b/tools/ui/scripts/git-hooks/pre-push.sh
index 66d79b950a36f506750ea2ee96ea0bc806d86f94..d5598fb17a9aa9c60ff25d0f791d1fde12e7b06b 100755 (executable)
--- a/tools/ui/scripts/git-hooks/pre-push.sh
+++ b/tools/ui/scripts/git-hooks/pre-push.sh
@@ -30,7 +30,7 @@ cd "$REPO_ROOT/tools/ui"
 
 # Check that node_modules exists
 if [ ! -d "node_modules" ]; then
-    echo "❌ node_modules not found. Run 'npm install' first."
+    echo "❌ node_modules not found. Run 'npm ci' first."
     exit 1
 fi