ci: dynamically allow DMV git tarball builds

[igoroctaviano]

Summary

• Dynamically insert the resolved DMV commit SHA into pnpm-workspace.yaml's allowBuilds during CI
• Fixes pnpm 11's dependency status check failing when using git-hosted dicom-microscopy-viewer

Problem

pnpm 11 introduced a security feature that blocks build scripts from dependencies by default. When the Firebase preview workflow resolves a DMV branch to a specific commit SHA, pnpm stores it as dicom-microscopy-viewer@https://codeload.github.com/.../tar.gz/<SHA>. The static allowBuilds: dicom-microscopy-viewer: true entry only matches npm-published versions, not git tarballs.

Previously, this required hardcoding the SHA in pnpm-workspace.yaml, which went stale whenever the DMV branch got new commits.

Solution

The workflow now dynamically inserts the resolved tarball URL into allowBuilds before running pnpm install, so any DMV commit SHA is automatically approved.

Test plan

• Local pre-push hooks pass (lint, typecheck, build, tests)
• CI passes on this PR
• Verify PR feat: consume dmv deck.gl bulk annotations; drop clustering UI #405 passes after merging this fix

🤖 Generated with Claude Code

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[deepsource-io]

DeepSource Code Review

We reviewed changes in d5e44f3...c9395bd on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.

See full review on DeepSource ↗

PR Report Card

Overall Grade

Security   Reliability   Complexity   Hygiene

Code Review Summary

Analyzer	Status	Updated (UTC)	Details
JavaScript		Aug 14, 2026 12:38p.m.	Review ↗

---

Important

AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.

[github-actions]

📦 Firebase Preview - Using Published DMV

This preview is using the published dicom-microscopy-viewer from package.json:

Version	^0.48.23

To link a DMV branch for testing (requires an open PR in DMV):

• Add dmv-branch: <branch-name> to the PR description, OR
• Use the same branch name in both repos (automatic matching)

[github-actions]

Visit the preview URL for this PR (updated for commit c9395bd):

https://idc-external-006--pr424-fix-dynamic-dmv-allo-maaxmd8h.web.app

_{(expires Fri, 21 Aug 2026 12:41:04 GMT)}

_{🔥 via Firebase Hosting GitHub Action 🌎}

_{Sign: 88aacecd98ba54d2f9c8d201a9444e43d1ad8307}