fix(ci): make the build installable by pinning the unreleased SDK

The CI failed at install: `@gladysassistant/integration-sdk@^0.10.0` does
not exist on npm — the weather API is still an open pull request
(integration-sdk-js#19), so nothing could be installed and no test could
run.

Pin the dependency to the source archive of that pull request's commit,
which makes `npm install`, `npm ci` and the Docker build work today:

  https://github.com/GladysAssistant/integration-sdk-js/archive/af9d20b....tar.gz

An https tarball rather than a `git+https://` dependency on purpose: npm
rewrites GitHub git dependencies to `git+ssh://` in the lockfile, which
fails on a CI runner with no SSH key. The tarball resolves over plain
https, is pinned to an immutable commit, carries an integrity hash and
needs no git in the image.

With a resolvable dependency there is a lockfile again, so `npm ci` and
the npm cache come back in the CI workflow, and the release workflow
commits package-lock.json unconditionally.

The README says what to revert once the SDK publishes the weather API.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NjFeSaeYevwCQa2KrZ74eZ

Author: Pierre-Gilles

.github/workflows/ci.yml

@@ -30,15 +30,10 @@ jobs:
         uses: actions/setup-node@v4
         with:
           node-version: 24
+          cache: npm
 
-      # No `cache: npm` and no `npm ci`: this repository has no committed
-      # lockfile yet, because the SDK version carrying the weather API
-      # (`onWeatherGet`, spec B.18) is not published on npm at the time of
-      # writing — see the note in the README. Once it is, run `npm install`
-      # once, commit `package-lock.json`, and this step can go back to
-      # `cache: npm` + `npm ci`.
       - name: Install dependencies
-        run: npm ci --no-audit --no-fund || npm install --no-audit --no-fund
+        run: npm ci
 
       - name: Check formatting (Prettier)
         run: npm run format:check

.github/workflows/release.yml

@@ -85,10 +85,7 @@ jobs:
           git config user.name  "github-actions[bot]"
           git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
 
-          # package-lock.json is only added when the repository has one (see
-          # the note in .github/workflows/ci.yml).
-          git add package.json gladys-assistant-integration.json
-          [ -f package-lock.json ] && git add package-lock.json || true
+          git add package.json package-lock.json gladys-assistant-integration.json
           git commit -m "chore(release): ${VERSION}"
           git tag -a "v${VERSION}" -m "Release ${VERSION}"
 

README.md

@@ -101,21 +101,37 @@ provider never sends a field it does not have.
 ## Requirements
 
 - **Node.js ≥ 20** (uses the built-in global `fetch`; no HTTP dependency).
-- **`@gladysassistant/integration-sdk` ≥ 0.10.0** — the version that ships the
-  weather API (`onWeatherGet`, `WEATHER_CONDITIONS`,
-  `WEATHER_ALERT_SEVERITIES`, `WEATHER_ALERT_TYPES`).
+- **`@gladysassistant/integration-sdk` with the weather API** — `onWeatherGet`,
+  `WEATHER_CONDITIONS`, `WEATHER_ALERT_SEVERITIES`, `WEATHER_ALERT_TYPES`.
 - A **Gladys** with weather-integration support (spec B.18); the manifest
   declares the range in `gladys_version`.
 
-> **Note — unreleased dependencies.** At the time of writing, both the SDK
-> weather API ([integration-sdk-js#19](https://github.com/GladysAssistant/integration-sdk-js/pull/19))
+> **⚠️ Temporary: the SDK is pinned to an unreleased commit.**
+> The SDK weather API ([integration-sdk-js#19](https://github.com/GladysAssistant/integration-sdk-js/pull/19))
 > and the Gladys core support ([Gladys#2738](https://github.com/GladysAssistant/Gladys/pull/2738))
-> are open pull requests. `npm install` therefore cannot resolve
-> `@gladysassistant/integration-sdk@^0.10.0` yet, and this repository ships no
-> `package-lock.json` for that reason. Once the SDK is published: run
-> `npm install`, commit the lockfile, adjust `gladys_version` to the Gladys
-> release that carries B.18, and put `cache: npm` + `npm ci` back in
-> `.github/workflows/ci.yml`.
+> are both still open pull requests, so no published npm version carries
+> `onWeatherGet` yet. To keep this repository installable and its CI green,
+> `package.json` points at the source archive of the **exact commit** of the SDK
+> pull request:
+>
+> ```
+> https://github.com/GladysAssistant/integration-sdk-js/archive/af9d20b0e92415c242265c5ee0647f5c618332ec.tar.gz
+> ```
+>
+> An https tarball rather than a `git+…` dependency on purpose: npm rewrites
+> GitHub git dependencies to `git+ssh://` in the lockfile, which then fails on
+> any CI runner without an SSH key. The tarball resolves over plain https, is
+> pinned to an immutable commit, carries an integrity hash and needs no `git`
+> in the Docker image.
+>
+> **When the SDK ships the weather API, do these three things:**
+>
+> 1. set the dependency back to a plain version (`"^0.10.0"`) and run
+>    `npm install` to refresh `package-lock.json`;
+> 2. set `gladys_version` in the manifest to the Gladys release that carries
+>    B.18 (it currently guesses `>=4.85.0`);
+> 3. re-run `npx github:GladysAssistant/integration-store .` — the store schema
+>    only accepts `type: "weather"` once Gladys#2738 has landed.
 
 ## Run it locally