chore(ui): pin packageManager to npm@11.6.2

.github/workflows/ci.yaml

@@ -322,10 +322,15 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v6
         with:
-          node-version: "24"
+          node-version-file: ui/.nvmrc
           cache: "npm"
           cache-dependency-path: ui/package-lock.json
 
+      # Honor the pinned npm from ui/package.json "packageManager" so npm ci
+      # resolves the lock file with the same npm version it was generated with.
+      - name: Enable Corepack
+        run: corepack enable
+
       - name: Install dependencies
         working-directory: ./ui
         env:

.github/workflows/ui-chromatic.yaml

@@ -29,10 +29,15 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v6
         with:
-          node-version: "24"
+          node-version-file: ui/.nvmrc
           cache: "npm"
           cache-dependency-path: ui/package-lock.json
 
+      # Honor the pinned npm from ui/package.json "packageManager" so npm ci
+      # resolves the lock file with the same npm version it was generated with.
+      - name: Enable Corepack
+        run: corepack enable
+
       - name: Install dependencies
         working-directory: ./ui
         env:

ui/Dockerfile

@@ -10,7 +10,7 @@ ARG BUILDPLATFORM
 ARG TOOLS_NODE_VERSION
 
 RUN echo "Installing on $BUILDPLATFORM" \
-    && apk add --no-cache curl bash openssl unzip ca-certificates nginx supervisor "nodejs~${TOOLS_NODE_VERSION}" npm node-gyp \
+    && apk add --no-cache curl bash openssl unzip ca-certificates nginx supervisor "nodejs~${TOOLS_NODE_VERSION}" node-gyp \
     && update-ca-certificates
 
 ENV DO_NOT_TRACK=1
@@ -19,10 +19,13 @@ ENV CYPRESS_INSTALL_BINARY=0
 
 WORKDIR /app/ui
 
-# Copy package files and install dependencies
+# Pin npm to package.json's "packageManager" version; the wolfi-base default
+# npm is a newer major that rejects the committed package-lock.json.
 COPY package*.json ./
 RUN --mount=type=cache,target=/root/.npm,rw \
-    npm ci
+    NPM_VERSION="$(sed -n 's/.*"packageManager"[[:space:]]*:[[:space:]]*"npm@\([0-9.]*\)".*/\1/p' package.json)" \
+    && apk add --no-cache "npm=~${NPM_VERSION}" \
+    && npm ci
 
 ### STAGE 2: Build
 FROM --platform=$BUILDPLATFORM deps AS builder