[vuanhphung]

JFrog setup rewrites package-lock.json for dependency installation, leaving a tracked change outside the engineer bot's touched_files. This causes publishing to fail with “Unstaged paths remain after explicit staging,” as seen in this run.

Restore the committed lockfile immediately after npm ci in both the author and follow-up workflows, before the agent makes any edits.

Validation: Prettier, YAML parsing, shell syntax, and a temporary-repository reproduction confirming the registry rewrite is removed and subsequent agent edits stage without leftover changes. A live bot run is still needed after merge.

[peco-review-bot]

Verdict: 1 Low

Looks good. The fix targets the only tracked file that setup-jfrog rewrites, and it runs after npm ci has consumed the JFrog-resolved lockfile and before the agent makes any edits, in both workflows. One low-severity suggestion: add a fail-fast check so the workflows fail early if setup ever leaves other tracked changes.

[peco-review-bot]

🔵 Low — This restores only package-lock.json, which matches what setup-jfrog rewrites today (.github/actions/setup-jfrog/action.yml:51-58). If setup ever touches another tracked file (for example, a prepare/build step that writes into a tracked path, or a new rewrite in setup-jfrog), the failure will come back. It would also show up late, as the same opaque "Unstaged paths remain" error in publish, after a full agent run.

Consider adding a fail-fast check right after the restore so setup churn is caught before the agent runs, e.g.:

run: |
  git restore --source=HEAD --worktree -- package-lock.json
  git diff --exit-code || { echo "::error::setup left tracked changes"; exit 1; }

The same applies to the follow-up workflow's restore step.