Fix the remaining audit alerts (#33370)

Author: alexslavr

.github/actions/run-qunit-tests/action.yml

@@ -42,13 +42,21 @@ runs:
         echo "MATRIX_ENVS_NAME_SAFE=$MATRIX_ENVS_NAME_SAFE"
         echo "MATRIX_ENVS_NAME_SAFE=$MATRIX_ENVS_NAME_SAFE" >> $GITHUB_ENV
 
-#    - name: Update apt
-#      run: |
-#        sudo apt-get update
+    - name: Use Node.js
+      uses: actions/setup-node@v4
+      with:
+        node-version: '20'
 
-#    - name: Setup utils
-#      run: |
-#        sudo apt-get install -y dbus-x11 httping x11vnc xvfb
+    - name: Restore npm cache
+      uses: actions/cache@v4
+      with:
+        path: '**/node_modules'
+        key: ${{ runner.os }}-node-modules-${{ hashFiles('**/package-lock.json') }}
+        restore-keys: ${{ runner.os }}-node-modules
+
+    - name: Run npm ci
+      shell: bash
+      run: npm ci --no-audit --no-fund
 
     - name: Setup Chrome
       if: ${{ inputs.browser == 'chrome' }}
@@ -75,22 +83,6 @@ runs:
       with:
         firefox-version: '122.0.1'
 
-    - name: Use Node.js
-      uses: actions/setup-node@v4
-      with:
-        node-version: '20'
-
-    - name: Restore npm cache
-      uses: actions/cache@v4
-      with:
-        path: '**/node_modules'
-        key: ${{ runner.os }}-node-modules-${{ hashFiles('**/package-lock.json') }}
-        restore-keys: ${{ runner.os }}-node-modules
-
-    - name: Run npm ci
-      shell: bash
-      run: npm ci --no-audit --no-fund
-
     - name: Download artifacts
       uses: actions/download-artifact@v4
       with:

.github/actions/setup-chrome-headless-shell/action.yml

@@ -19,9 +19,10 @@ runs:
       run: |
         if [ -n "$CHROME_VERSION" ]; then
           echo "version to install: $CHROME_VERSION"
-          CHROME_BIN=`npx @puppeteer/browsers install chrome-headless-shell@$CHROME_VERSION | awk '{print $2}'`
-          chmod +x $CHROME_BIN
+          PUPPETEER_CMD="install chrome-headless-shell@$CHROME_VERSION"
+          CHROME_BIN=`npx --no-install @puppeteer/browsers $PUPPETEER_CMD | awk '{print $2}'`
           echo "chrome-headless-shell installed in: $CHROME_BIN"
+          chmod +x $CHROME_BIN
           $CHROME_BIN --version
           echo "CHROME_SHELL=$CHROME_BIN" >> $GITHUB_ENV
         else

.github/workflows/demos_visual_tests_frameworks.yml

@@ -205,7 +205,23 @@ jobs:
         name: devextreme-sources
 
     - name: Install packages
-      run: npm install devextreme-installer.tgz devextreme-dist-installer.tgz devextreme-react-installer.tgz devextreme-vue-installer.tgz devextreme-angular-installer.tgz
+      run: npm ci
+
+  # NOTE: workaround due to wrappers are incorrect NPM packages now
+    - name: Install wrappers packages
+      run: |
+       rm -rf node_modules/devextreme node_modules/devextreme-dist node_modules/devextreme-angular node_modules/devextreme-react node_modules/devextreme-vue
+       mkdir node_modules/devextreme node_modules/devextreme-dist node_modules/devextreme-angular node_modules/devextreme-react node_modules/devextreme-vue
+       tar -xzf devextreme-installer.tgz -C node_modules/devextreme
+       mv node_modules/devextreme/package/* node_modules/devextreme
+       tar -xzf devextreme-dist-installer.tgz -C node_modules/devextreme-dist
+       mv node_modules/devextreme-dist/package/* node_modules/devextreme-dist
+       tar -xzf devextreme-angular-installer.tgz -C node_modules/devextreme-angular
+       mv node_modules/devextreme-angular/package/* node_modules/devextreme-angular
+       tar -xzf devextreme-react-installer.tgz -C node_modules/devextreme-react
+       mv node_modules/devextreme-react/package/* node_modules/devextreme-react
+       tar -xzf devextreme-vue-installer.tgz -C node_modules/devextreme-vue
+       mv node_modules/devextreme-vue/package/* node_modules/devextreme-vue
 
     - uses: actions/setup-dotnet@v3
       with:

.github/workflows/lint.yml

@@ -174,34 +174,6 @@ jobs:
       working-directory: ./packages/devextreme-scss
       run: npx --no-install nx lint
 
-  package_lock:
-    runs-on: devextreme-shr2
-    timeout-minutes: 10
-    steps:
-    - name: Get sources
-      uses: actions/checkout@v4
-
-    - name: Use Node.js
-      uses: actions/setup-node@v4
-      with:
-        node-version: '20'
-
-    - name: Update package-lock
-      run: |
-        node -v
-        npm -v
-        npm ci --no-audit --no-fund --ignore-scripts
-
-    - name: Upload package-lock
-      uses: actions/upload-artifact@v4
-      with:
-        name: package-lock.json
-        path: ./package-lock.json
-        retention-days: 1
-
-    - name: Check package-lock
-      run: git diff --exit-code package-lock.json
-
   component_exports:
     runs-on: devextreme-shr2
     timeout-minutes: 10
@@ -270,7 +242,7 @@ jobs:
   notify:
     runs-on: devextreme-shr2
     name: Send notifications
-    needs: [Renovation, TS, JS, CSS, texts, package_lock, component_exports]
+    needs: [Renovation, TS, JS, CSS, texts, component_exports]
     if: github.event_name != 'pull_request' && contains(needs.*.result, 'failure')
 
     steps:

.github/workflows/packages_publishing.yml

@@ -72,7 +72,7 @@ jobs:
           cp reportGithub.json ./artifacts/deps-scanner/
 
       - name: Build artifacts package
-        run: npx -no-install ts-node tools/scripts/make-artifacts-package
+        run: npx --no-install ts-node tools/scripts/make-artifacts-package
 
       - uses: actions/upload-artifact@v4
         with:
@@ -97,28 +97,22 @@ jobs:
     steps:
       - name: Get sources
         uses: actions/checkout@v4
-        with:
-          sparse-checkout: |
-            /tools
-            /packages/devextreme-monorepo-tools
-            package.json
-          sparse-checkout-cone-mode: false
 
       - name: Download artifacts
         uses: actions/download-artifact@v4
         with:
           name: packages
 
       - name: Install dependencies
-        run: npm install --no-audit --no-fund --legacy-peer-deps --ignore-scripts
+        run: npm ci --no-audit --no-fund --legacy-peer-deps --ignore-scripts
 
       - name: Change package scope
         id: scopedPackage
         env:
           PACKAGE: ${{ matrix.package }}
         run: |
           SCOPE=$(echo "${{ github.repository_owner }}" | tr '[:upper:]' '[:lower:]');
-          PACKAGE_DIR=$(npx ts-node tools/scripts/change-package-scope --tgz $PACKAGE.tgz --scope $SCOPE)
+          PACKAGE_DIR=$(npx --no-install ts-node tools/scripts/change-package-scope --tgz $PACKAGE.tgz --scope $SCOPE)
           echo "packageDir=$PACKAGE_DIR" >> "$GITHUB_OUTPUT";
           cd $PACKAGE_DIR;
           npm pkg get name --workspaces=false | tr -d '"' | sed -r 's/(.*)/name=\1/' >> "$GITHUB_OUTPUT";

.github/workflows/themebuilder_tests.yml

@@ -34,7 +34,7 @@ jobs:
 
     - name: Build etalon bundles
       working-directory: ./packages/devextreme-scss
-      run: npx gulp style-compiler-themes-ci
+      run: npx --no-install gulp style-compiler-themes-ci
 
     - name: Build
       working-directory: ./packages/devextreme-themebuilder