fix: disable yarn install scripts now that better-sqlite3 uses prebuilds

.github/actions/setup-cluster-free-harness/action.yaml

@@ -34,18 +34,11 @@ runs:
 
     # Both harnesses boot packages/backend from source, which needs the ROOT
     # workspace dependencies; e2e-tests has its own lockfile.
-    #
-    # Lifecycle scripts stay enabled here (unlike the e2e-tests install below).
-    # The harness backend runs on better-sqlite3, whose native binding is
-    # fetched by its install script, so --mode=skip-build would leave the
-    # backend unable to boot. Same plain `yarn install` the other workflows use.
     - name: Install dependencies (root)
       shell: bash
       run: yarn install
 
-    # skip-build skips the postinstall `playwright install chromium`: the
-    # Playwright container already ships the browsers.
     - name: Install dependencies (e2e-tests)
       shell: bash
       working-directory: ./e2e-tests
-      run: yarn install --mode=skip-build
+      run: yarn install

.github/workflows/e2e-tests-lint.yaml

@@ -33,7 +33,7 @@ jobs:
 
       - name: Install dependencies e2e-tests
         working-directory: ./e2e-tests
-        run: yarn install --mode=skip-build
+        run: yarn install
 
       - name: Run Oxlint
         working-directory: ./e2e-tests

.sonarcloud.properties

@@ -5,21 +5,9 @@ sonar.tests= .
 # Include test subdirectories in test scope
 sonar.test.inclusions = e2e-tests/**/*, **/*.test.*
 
-# Exclude test and CI infrastructure from source scope
-# The setup action is excluded for githubactions:S6505 ("Lifecycle scripts are
-# enabled by default in Yarn v2+") on its root `yarn install`. The rule's fix
-# breaks the build: the cluster-free harness backend runs on better-sqlite3,
-# which declares `install: prebuild-install || node-gyp rebuild` and ships no
-# prebuilt binary, so with scripts disabled there is no native binding and the
-# backend cannot boot. That line is also the pre-existing install this PR only
-# moved into a composite action. Scoped to the one file rather than .github/**,
-# which would leave the workflows unscanned (CodeQL here only runs javascript).
-#
-# Also drop the hub Containerfile: docker:S8431 flags FROM image:tag@sha256:...
-# which is the pinDigest form Konflux and "Validate Image Digests" require.
-# Dockerfile parsers reject NOSONAR, and sonar.issue.ignore.multicriteria is
-# ignored by SonarCloud Automatic Analysis (see #5076; still failing on #5319).
-# sonar.exclusions is honoured. Hadolint still lints these files.
+# e2e-tests/**, .ci/**, **/*.test.* — test/CI paths, not product source (tests scoped above).
+# setup-cluster-free-harness/action.yaml — S6505 false positive on `yarn install` (file-scoped so other workflows stay scanned).
+# build/containerfiles/Containerfile — S8431 false positive on digest-pinned FROM (see #5076).
 sonar.exclusions = e2e-tests/**/*, .ci/**/*, **/*.test.*, .github/actions/setup-cluster-free-harness/action.yaml, build/containerfiles/Containerfile
 
 # comma delimited path of files to exclude from copy/paste duplicate checking

.yarnrc.yml

@@ -1,8 +1,5 @@
 nodeLinker: node-modules
 
-# Yarn 4.17+ defaults enableScripts to false; native deps (better-sqlite3) need builds.
-enableScripts: true
-
 npmPreapprovedPackages:
   - "@backstage/*"
 

docs/e2e-tests/README.md

@@ -24,13 +24,6 @@ From the root of the project directory, navigate to the `e2e-tests` directory:
 ```bash
 cd e2e-tests
 yarn install
-```
-
-## Install Playwright Browsers
-
-The Playwright browsers should be installed automatically via the `postinstall` script in `package.json`. If not, you can manually install them:
-
-```bash
 yarn playwright install chromium
 ```
 
@@ -55,7 +48,7 @@ To run the tests, ensure you have:
 
 - **Node.js** (minimum version 18)
 - An instance of the application to run the tests against
-- [Playwright browsers installed](#install-playwright-browsers)
+- [Playwright browsers installed](#navigate-to-the-e2e-tests-directory-and-install-dependencies)
 
 #### macOS Users
 

docs/index.md

@@ -202,12 +202,7 @@ The easiest and fastest method for getting started: RHDH app, running it locally
 
 1. Copy `app-config.example.yaml` and rename it as `app-config.local.yaml`.
 
-2. Ensure you have the following developer tools installed:
-
-   - If you are on a Fedora/Red Hat Linux distribution run: `sudo dnf install python3 make g++ zlib-devel brotli-devel openssl-devel libuv-devel`
-   - If you are on a Debian/Ubuntu Linux distribution run: `sudo apt-get install python3 g++ build-essential`
-   - If you are on Windows, then follow the [instructions](https://github.com/nodejs/node-gyp#on-windows) in `node-gyp` for Windows
-   - If you are on macOS, then follow the [instructions](https://github.com/nodejs/node-gyp#on-macos) in `node-gyp` for macOS
+2. Use the Node.js version from `.nvmrc` and enable Corepack (`corepack enable`) so the Yarn version pinned in `package.json` is used.
 
 3. Run `yarn install` to install the dependencies
 
@@ -219,12 +214,7 @@ The easiest and fastest method for getting started: RHDH app, running it locally
 
 1. Create an `app-config.local.yaml` file that will be used for storing the environment variables that the showcase app needs
 
-2. Ensure you have the following developer tools installed:
-
-   - If you are on a Fedora/Red Hat Linux distribution run: `sudo dnf install python3 make g++ zlib-devel brotli-devel openssl-devel libuv-devel`
-   - If you are on a Debian/Ubuntu Linux distribution run: `sudo apt-get install python3 g++ build-essential`
-   - If you are on Windows, then follow the [instructions](https://github.com/nodejs/node-gyp#on-windows) in `node-gyp` for Windows
-   - If you are on macOS, then follow the [instructions](https://github.com/nodejs/node-gyp#on-macos) in `node-gyp` for macOS
+2. Use the Node.js version from `.nvmrc` and enable Corepack (`corepack enable`) so the Yarn version pinned in `package.json` is used.
 
 3. Run `yarn install` to install the dependencies
 

e2e-tests/package.json

@@ -26,7 +26,6 @@
     "test:unit": "vitest run",
     "fmt": "oxfmt .",
     "fmt:check": "oxfmt --check .",
-    "postinstall": "playwright install chromium",
     "shellcheck": "git ls-files -z '*.sh' | xargs -0 shellcheck --severity=warning --color=always",
     "e2e:legacy-local": "playwright test --config=playwright.legacy-local.config.ts",
     "e2e:plugin-sanity": "playwright test --config=playwright.plugin-sanity.config.ts"

package.json

@@ -50,16 +50,10 @@
     "jest": "30.4.2",
     "jsdom": "27.4.0",
     "lint-staged": "15.5.2",
-    "node-gyp": "10.3.1",
     "rulesync": "7.30.0",
     "sherif": "1.13.0",
     "turbo": "2.10.12"
   },
-  "dependenciesMeta": {
-    "keytar": {
-      "built": false
-    }
-  },
   "resolutions": {
     "refractor@npm:3.6.0/prismjs": "^1.30.0"
   },