fix(ci): use npm-shrinkwrap.json for node_modules cache key

[Hweinstock]

Description

The Quality and Safety Checks workflow caches node_modules using hashFiles('package-lock.json') as the key, but package-lock.json is no longer tracked since it was replaced by npm-shrinkwrap.json. This causes hashFiles to return an empty string, so the cache key is always node-modules- (constant across all runs).

This means:

1. The setup job's cache save races with itself and often fails ("another job may be creating this cache")
2. Downstream jobs (lint, typecheck) restore a stale node_modules from a previous run with older SDK type definitions
3. eslint's type-checked rules fail with "type that could not be resolved" errors that cannot be reproduced locally

The fix changes all hashFiles('package-lock.json') references to hashFiles('npm-shrinkwrap.json').

Related Issue

Closes #

Documentation PR

N/A

Type of Change

• Bug fix
• New feature
• Breaking change
• Documentation update
• Other (please describe):

Testing

• I ran npm run test:unit and npm run test:integ
• I ran npm run typecheck
• I ran npm run lint
• If I modified src/assets/, I ran npm run test:update-snapshots and committed the updated snapshots

Checklist

• I have read the CONTRIBUTING document
• I have added any necessary tests that prove my fix is effective or my feature works
• I have updated the documentation accordingly
• I have added an appropriate example to the documentation to outline the feature, or no new docs are needed
• My changes generate no new warnings
• Any dependent changes have been merged and published

---

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the
terms of your choice.

[github-actions]

Package Tarball

aws-agentcore-0.14.1.tgz

How to install

gh release download pr-1325-tarball --repo aws/agentcore-cli --pattern "*.tgz" --dir /tmp/pr-tarball
npm install -g /tmp/pr-tarball/aws-agentcore-0.14.1.tgz

[agentcore-devx-automation]

Claude Security Review: no high-confidence findings. (run)

[agentcore-cli-automation]

Verified the analysis: npm-shrinkwrap.json is the only lockfile tracked in the repo (package-lock.json is not committed), so hashFiles('package-lock.json') returns an empty string and the cache key collapses to a constant node-modules- across all runs — matching the symptoms described.

The fix replaces all 6 occurrences in .github/workflows/lint.yml consistently. Other references to package-lock.json in sync-preview.yml and pr-size.yml are intentional (sync-preview generates one from upstream; pr-size filters it from diff size) and correctly left alone.

Note: existing caches keyed as node-modules- will linger until they expire (7 days idle) or are manually evicted, but that's harmless — the new key simply won't match them and the setup job will populate the correct cache on first run after merge.

LGTM.