Description

The pre-release version bump workflow (release-prerelease-pr.yml) calls Update-VersionFiles.ps1 to bump package.json to the next pre-release version but never runs npm install afterward. This leaves package-lock.json with the previous version, creating a mismatch between the two files.

The same gap exists in release-stable.yml for the post-release reset path.

Additionally, because hve-core is a private package ("private": true) and is never published to npm, the dependency-review-action reports it with Null license and Unknown OSSF Scorecard score whenever the version changes. The root package should be excluded from license and OSSF checks.

Root Cause

1. Lockfile sync: Update-VersionFiles.ps1 updates package.json, package.template.json, marketplace JSON files, plugin JSON files, and .release-please-manifest.json — but does not sync package-lock.json. Both workflows run npm ci before the version bump (to install tools), not after.
2. License/OSSF warnings: The dependency-review-action queries the npm registry for license and scorecard data. Since hve-core is private and unpublished, the registry returns nothing, producing Null license and Unknown score warnings on every version-bump PR.

Evidence

• git log --oneline origin/prerelease/next --author="github-actions" -- package-lock.json returns empty — the bot has never committed a package-lock.json change.
• PR chore(main): pre-release 3.3.27 #1191 shows package.json bumped to 3.3.26 while package-lock.json remains at 3.3.25.
• PR chore(main): pre-release 3.3.27 #1191 Dependency Review comment reports hve-core 3.3.26 with Null license and Unknown OSSF score.

Fix

1. Add npm install --package-lock-only after Update-VersionFiles.ps1 in both release-prerelease-pr.yml and release-stable.yml.
2. Add pkg:npm/hve-core to allow-dependencies-licenses in dependency-review.yml to exclude the private root package from license and OSSF checks.

Affected Files

• .github/workflows/release-prerelease-pr.yml
• .github/workflows/release-stable.yml
• .github/workflows/dependency-review.yml