ci: support sdk-scoped package lock

.github/workflows/canary.yml

@@ -43,6 +43,7 @@ jobs:
           node-version: ${{ env.NODE_VERSION }}
           registry-url: 'https://registry.npmjs.org'
           cache: 'npm'
+          cache-dependency-path: sdk/package-lock.json
 
       - name: Determine canary version
         id: canary
@@ -72,7 +73,7 @@ jobs:
 
       - name: Install and test
         run: |
-          npm ci
+          npm install --no-package-lock
           npm test
 
       - name: Build SDK dist for tarball

.github/workflows/hotfix.yml

@@ -244,7 +244,7 @@ jobs:
         run: |
           set -euo pipefail
           npm version "$VERSION" --no-git-tag-version
-          git add package.json package-lock.json
+          git add package.json
           # Keep sdk/package.json in lockstep (parity with release-sdk.yml).
           if [ -f sdk/package.json ]; then
             (cd sdk && npm version "$VERSION" --no-git-tag-version)
@@ -295,6 +295,7 @@ jobs:
           node-version: ${{ env.NODE_VERSION }}
           registry-url: 'https://registry.npmjs.org'
           cache: 'npm'
+          cache-dependency-path: sdk/package-lock.json
 
       - name: Configure git identity
         run: |
@@ -316,7 +317,7 @@ jobs:
 
       - name: Install and test
         run: |
-          npm ci
+          npm install --no-package-lock
           npm run test:coverage
 
       - name: Build SDK dist for tarball

.github/workflows/install-smoke.yml

@@ -22,7 +22,7 @@ on:
       - 'bin/gsd-sdk.js'
       - 'sdk/**'
       - 'package.json'
-      - 'package-lock.json'
+      - 'sdk/package-lock.json'
       - '.github/workflows/install-smoke.yml'
       - '.github/workflows/release.yml'
   push:
@@ -117,10 +117,11 @@ jobs:
         with:
           node-version: ${{ matrix.node-version }}
           cache: 'npm'
+          cache-dependency-path: sdk/package-lock.json
 
       - name: Install root deps
         if: steps.skip.outputs.skip != 'true'
-        run: npm ci
+        run: npm install --no-package-lock
 
       # Isolated SDK typecheck — if the build fails, emit a clear "stale base
       # or real type error" diagnostic instead of letting the failure cascade
@@ -242,9 +243,10 @@ jobs:
         with:
           node-version: 22
           cache: 'npm'
+          cache-dependency-path: sdk/package-lock.json
 
       - name: Install root deps
-        run: npm ci
+        run: npm install --no-package-lock
 
       - name: Build SDK dist (sdk/dist is gitignored — must build for unpacked install)
         run: npm run build:sdk

.github/workflows/release-sdk.yml

@@ -391,7 +391,7 @@ jobs:
           CURRENT=$(node -p "require('./package.json').version")
           if [ "$CURRENT" != "$VERSION" ]; then
             npm version "$VERSION" --no-git-tag-version
-            git add package.json package-lock.json
+            git add package.json
             if [ -f sdk/package.json ]; then
               (cd sdk && npm version "$VERSION" --no-git-tag-version)
               git add sdk/package.json
@@ -455,6 +455,7 @@ jobs:
           node-version: ${{ env.NODE_VERSION }}
           registry-url: 'https://registry.npmjs.org'
           cache: 'npm'
+          cache-dependency-path: sdk/package-lock.json
 
       - name: Determine version
         id: ver
@@ -561,7 +562,7 @@ jobs:
           cd sdk && npm version "$VERSION" --no-git-tag-version --allow-same-version
 
       - name: Install dependencies
-        run: npm ci
+        run: npm install --no-package-lock
 
       - name: Run full test suite with coverage (parity with release.yml)
         run: npm run test:coverage

.github/workflows/release.yml

@@ -100,7 +100,8 @@ jobs:
           git checkout -b "$BRANCH"
           npm version "$VERSION" --no-git-tag-version
           cd sdk && npm version "$VERSION" --no-git-tag-version && cd ..
-          git add package.json package-lock.json sdk/package.json
+          git add package.json sdk/package.json
+          [ -f sdk/package-lock.json ] && git add sdk/package-lock.json
           git commit -m "chore: bump version to ${VERSION} for release"
           git push origin "$BRANCH"
           echo "## Release branch created" >> "$GITHUB_STEP_SUMMARY"
@@ -143,6 +144,7 @@ jobs:
           node-version: ${{ env.NODE_VERSION }}
           registry-url: 'https://registry.npmjs.org'
           cache: 'npm'
+          cache-dependency-path: sdk/package-lock.json
 
       - name: Determine pre-release version
         id: prerelease
@@ -179,14 +181,15 @@ jobs:
 
       - name: Install and test
         run: |
-          npm ci
+          npm install --no-package-lock
           npm run test:coverage
 
       - name: Commit pre-release version bump
         env:
           PRE_VERSION: ${{ steps.prerelease.outputs.pre_version }}
         run: |
-          git add package.json package-lock.json sdk/package.json
+          git add package.json sdk/package.json
+          [ -f sdk/package-lock.json ] && git add sdk/package-lock.json
           git commit -m "chore: bump to ${PRE_VERSION}"
 
       - name: Build SDK dist for tarball
@@ -313,6 +316,7 @@ jobs:
           node-version: ${{ env.NODE_VERSION }}
           registry-url: 'https://registry.npmjs.org'
           cache: 'npm'
+          cache-dependency-path: sdk/package-lock.json
 
       - name: Configure git identity
         run: |
@@ -325,12 +329,13 @@ jobs:
         run: |
           npm version "$VERSION" --no-git-tag-version --allow-same-version
           cd sdk && npm version "$VERSION" --no-git-tag-version --allow-same-version && cd ..
-          git add package.json package-lock.json sdk/package.json
+          git add package.json sdk/package.json
+          [ -f sdk/package-lock.json ] && git add sdk/package-lock.json
           git diff --cached --quiet || git commit -m "chore: finalize v${VERSION}"
 
       - name: Install and test
         run: |
-          npm ci
+          npm install --no-package-lock
           npm run test:coverage
 
       - name: Build SDK dist for tarball

.github/workflows/test.yml

@@ -84,9 +84,10 @@ jobs:
         with:
           node-version: ${{ matrix.node-version }}
           cache: 'npm'
+          cache-dependency-path: sdk/package-lock.json
 
       - name: Install dependencies
-        run: npm ci
+        run: npm install --no-package-lock
 
       - name: Build SDK dist (required by installer)
         run: npm run build:sdk