From a0ef927faab4d4da7eadd03df3b452edb706b87a Mon Sep 17 00:00:00 2001
From: Alejandro Alonso <alejandro.alonso@kaleidos.net>
Date: Mon, 26 Oct 2026 07:05:13 +0100
Subject: [PATCH] :ambulance: Drop invoke_* glue checks from staging CI
 (#12623)

* :ambulance: Drop invoke_* glue checks from staging CI

The .github backport from develop added check-no-invoke-v to WASM and
Exporter CI, but staging still ships glue that uses invoke_* wrappers.
Remove those steps (and the WASM production build only used by the
check) so staging CI matches the binary it builds.

* :wrench: Disable credential persistence in commit-checker checkout

zizmor fails CI: Workflows when actions/checkout omits
persist-credentials: false. Match the rest of the workflows.
---
 .github/workflows/commit-checker.yml |  1 +
 .github/workflows/tests-exporter.yml |  5 -----
 .github/workflows/tests-wasm.yml     | 10 ----------
 3 files changed, 1 insertion(+), 15 deletions(-)

diff --git a/.github/workflows/commit-checker.yml b/.github/workflows/commit-checker.yml
index 15790e72a9..d245e6cd14 100644
--- a/.github/workflows/commit-checker.yml
+++ b/.github/workflows/commit-checker.yml
@@ -58,6 +58,7 @@ jobs:
       - name: Checkout trusted code
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
+          persist-credentials: false
           fetch-depth: 0
           ref: ${{ github.event.pull_request.base.sha || github.sha }}
 
diff --git a/.github/workflows/tests-exporter.yml b/.github/workflows/tests-exporter.yml
index ed0da17b28..82b7b12f73 100644
--- a/.github/workflows/tests-exporter.yml
+++ b/.github/workflows/tests-exporter.yml
@@ -61,8 +61,3 @@ jobs:
         working-directory: ./exporter
         run: |
           ./scripts/test
-
-      - name: Check no invoke_* in exporter JS glue
-        working-directory: ./render-wasm
-        run: |
-          ./check-no-invoke-v export
diff --git a/.github/workflows/tests-wasm.yml b/.github/workflows/tests-wasm.yml
index eac2d7ebf3..f3e1547321 100644
--- a/.github/workflows/tests-wasm.yml
+++ b/.github/workflows/tests-wasm.yml
@@ -60,13 +60,3 @@ jobs:
         working-directory: ./render-wasm
         run: |
           ./test
-
-      - name: Build
-        working-directory: ./render-wasm
-        run: |
-          NODE_ENV=production ./build frontend
-
-      - name: Check no invoke_*V in JS glue
-        working-directory: ./render-wasm
-        run: |
-          ./check-no-invoke-v