From b0ab255a682f5b81d931d9272b7d31ab6718c0e4 Mon Sep 17 00:00:00 2001
From: whyour <imwhyour@gmail.com>
Date: Tue, 25 Aug 2026 00:22:18 +0800
Subject: [PATCH] fix(ci): build Vault adapter workspace closure

---
 .github/workflows/ql3-ci.yml                  |  7 ++++---
 test/back/ql3CiCleanCheckoutContract.test.cjs | 11 +++++++++++
 2 files changed, 15 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/ql3-ci.yml b/.github/workflows/ql3-ci.yml
index 1d081a9c..db1d5696 100644
--- a/.github/workflows/ql3-ci.yml
+++ b/.github/workflows/ql3-ci.yml
@@ -1261,9 +1261,10 @@ jobs:
             "$(sha256sum "${RUNNER_TEMP}/kubectl" | cut -d ' ' -f 1)"
           chmod 0755 "${RUNNER_TEMP}/kubectl"
       - name: Build the direct custody adapter
-        run: |
-          pnpm --filter @qinglong/runtime-core build
-          pnpm --filter @qinglong/cluster-control build
+        run: >-
+          pnpm -r --workspace-concurrency=1
+          --filter @qinglong/cluster-control...
+          run build
       - name: Verify the fail-closed adapter and evidence contracts
         run: |
           node --test \
diff --git a/test/back/ql3CiCleanCheckoutContract.test.cjs b/test/back/ql3CiCleanCheckoutContract.test.cjs
index 5ea7bc6a..06ba176b 100644
--- a/test/back/ql3CiCleanCheckoutContract.test.cjs
+++ b/test/back/ql3CiCleanCheckoutContract.test.cjs
@@ -114,6 +114,17 @@ test('bootstraps jobs that previously depended on local modules or artifacts', (
     'pnpm run build:packages:ql3',
     'pnpm test:cloudnativepg-live:ql3',
   ]);
+
+  const vaultKvLive = jobSource(
+    'cluster-vault-kv-worker-secret-live',
+    'cluster-plugin-package-kubernetes-live',
+  );
+  assertOrdered(vaultKvLive, [
+    'pnpm install --frozen-lockfile --ignore-scripts',
+    'pnpm -r --workspace-concurrency=1',
+    '--filter @qinglong/cluster-control...',
+    'node --test',
+  ]);
 });
 
 test('rebuilds the only native legacy binding used by resource evidence', () => {