Agent-generated code passes tests locally but fails in CI (GitHub Actions): version differences, stale dependency cache, 'npm ci' lockfile out of sync, ubuntu-latest changed. How do I fix environment drift?

Cause: Local and CI environments differ in ways an agent (or developer) cannot see: OS image, language and tool versions, dependency versions resolved without a lockfile, leftover local files or services, environment variables, and caches. GitHub's ubuntu-latest label points at the latest stable GitHub-provided image, which its docs note may not be the newest version of the OS from the vendor; the label can change over time, and each job runs on a fresh VM, so nothing from your machine carries over. Fix (best first): 1. Reproduce CI conditions locally: start from a clean checkout in a fresh directory or container, install from scratch, and run the exact commands the workflow runs. Make the workflow the single source of truth for those commands (for example a Makefile or package script) and have the agent use the same ones. 2. Pin the toolchain. Declare language versions in the repo (for example .nvmrc, .python-version or a tool-versions file) and have the setup step read them instead of using a floating version. Pin the runner to a specific label such as ubuntu-24.04 instead of ubuntu-latest, and move it on purpose. 3. Use lockfile installs. npm ci installs from package-lock.json, deletes any existing node_modules, never rewrites the lockfile, and exits with an error if the lockfile and package.json disagree; fix that by running npm install locally and committing the updated lockfile. Use the equivalent frozen or locked install mode in other ecosystems, and commit the lockfile. 4. Keep caches honest. Include the lockfile hash in the cache key (hashFiles) and the runner OS. GitHub warns that restore-keys can restore dependencies from an older lockfile, so still run the install step. If you suspect a stale cache, change the key; a cache's contents cannot be edited. 5. Remove hidden local state: untracked files, locally exported environment variables, services running on your machine, files ignored by git. Declare required environment variables and services explicitly in the workflow. 6. Make time, locale, timezone and parallelism explicit in tests, and avoid tests that depend on directory ordering or network access. Verify: A clean clone (or a fresh container with the same image) passes the same command sequence as CI, and re-running the workflow with the cache cleared also passes. Print tool versions at the start of the job so differences are visible in logs. Sources: https://docs.github.com/en/actions/reference/runners/github-hosted-runners https://docs.github.com/en/actions/reference/workflows-and-actions/dependency-caching https://docs.npmjs.com/cli/v10/commands/npm-ci