Lock wrangler for playground deployments (#27838)

Pinning `cloudflare/wrangler-action` does not pin the `wrangler@4`
package it installs during deployment. Install Wrangler from a
dedicated, committed lockfile with lifecycle scripts disabled, then
invoke that local executable directly. Require `npm>=11.10.0` with
`engines.npm` and `engine-strict` so older clients cannot silently
ignore the seven-day `min-release-age` policy, and pin Node.js to
`24.19.0` at the install sites. Both playgrounds now use the reviewed
dependency tree already recorded for the playground API, and Cloudflare
credentials are passed only to the deployment command.

Related: astral-sh/ruff#27839 isolates the playground builds from
deployment credentials, and astral-sh/ruff#27844 enforces the
corresponding `npm` floor in the existing package roots.
astral-sh/ruff-vscode#1152 and astral-sh/ty-vscode#526 likewise give
credentialed publishers their own locked toolchains.

---------

Co-authored-by: zaniebot <242828183+zaniebot@users.noreply.github.com>

.github/workflows/ci.yaml

@@ -1076,8 +1076,18 @@ jobs:
         with:
           node-version: 24.19.0
           cache: "npm"
-          cache-dependency-path: playground/package-lock.json
+          cache-dependency-path: |
+            playground/package-lock.json
+            playground/deploy/package-lock.json
       - uses: jetli/wasm-bindgen-action@20b33e20595891ab1a0ed73145d8a21fc96e7c29 # v0.2.0
+      - name: "Check deployment dependencies"
+        env:
+          WRANGLER_SEND_METRICS: "false"
+          WRANGLER_SEND_ERROR_REPORTS: "false"
+        run: |
+          npm ci --ignore-scripts
+          ./node_modules/.bin/wrangler --version
+        working-directory: playground/deploy
       - name: "Install Node dependencies"
         run: npm ci --ignore-scripts
         working-directory: playground

.github/workflows/publish-playground.yml

@@ -49,11 +49,15 @@ jobs:
       - name: "Build Ruff playground"
         run: npm run build --workspace ruff-playground
         working-directory: playground
+      - name: "Install deployment dependencies"
+        if: ${{ env.CF_API_TOKEN_EXISTS == 'true' }}
+        run: npm ci --ignore-scripts
+        working-directory: playground/deploy
       - name: "Deploy to Cloudflare Pages"
         if: ${{ env.CF_API_TOKEN_EXISTS == 'true' }}
-        uses: cloudflare/wrangler-action@ebbaa1584979971c8614a24965b4405ff95890e0 # v4.0.0
-        with:
-          apiToken: ${{ secrets.CF_API_TOKEN }}
-          accountId: ${{ secrets.CF_ACCOUNT_ID }}
+        env:
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CF_API_TOKEN }}
+          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CF_ACCOUNT_ID }}
           # `github.head_ref` is only set during pull requests and for manual runs or tags we use `main` to deploy to production
-          command: pages deploy playground/ruff/dist --project-name=ruff-playground --branch ${{ github.head_ref || 'main' }} --commit-hash ${GITHUB_SHA}
+          DEPLOY_BRANCH: ${{ github.head_ref || 'main' }}
+        run: ./playground/deploy/node_modules/.bin/wrangler pages deploy playground/ruff/dist --project-name=ruff-playground --branch "$DEPLOY_BRANCH" --commit-hash "$GITHUB_SHA"

.github/workflows/publish-ty-playground.yml

@@ -59,11 +59,15 @@ jobs:
           test -f ty/dist/assets/pyodide-lock.json
           test -f ty/dist/assets/python_stdlib.zip
         working-directory: playground
+      - name: "Install deployment dependencies"
+        if: ${{ env.CF_API_TOKEN_EXISTS == 'true' }}
+        run: npm ci --ignore-scripts
+        working-directory: playground/deploy
       - name: "Deploy to Cloudflare Pages"
         if: ${{ env.CF_API_TOKEN_EXISTS == 'true' }}
-        uses: cloudflare/wrangler-action@ebbaa1584979971c8614a24965b4405ff95890e0 # v4.0.0
-        with:
-          apiToken: ${{ secrets.CF_API_TOKEN }}
-          accountId: ${{ secrets.CF_ACCOUNT_ID }}
+        env:
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CF_API_TOKEN }}
+          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CF_ACCOUNT_ID }}
           # `github.head_ref` is only set during pull requests and for manual runs or tags we use `main` to deploy to production
-          command: pages deploy playground/ty/dist --project-name=ty-playground --branch ${{ github.head_ref || 'main' }} --commit-hash ${GITHUB_SHA}
+          DEPLOY_BRANCH: ${{ github.head_ref || 'main' }}
+        run: ./playground/deploy/node_modules/.bin/wrangler pages deploy playground/ty/dist --project-name=ty-playground --branch "$DEPLOY_BRANCH" --commit-hash "$GITHUB_SHA"

playground/deploy/.npmrc

@@ -0,0 +1,3 @@
+engine-strict = true
+ignore-scripts = true
+min-release-age = 7

playground/deploy/package.json

@@ -0,0 +1,11 @@
+{
+  "name": "playground-deploy",
+  "private": true,
+  "version": "0.0.0",
+  "engines": {
+    "npm": ">=11.10.0"
+  },
+  "devDependencies": {
+    "wrangler": "4.118.0"
+  }
+}