fix: resolve npx double package install failure

.github/workflows/build.yaml

@@ -71,6 +71,26 @@ jobs:
           npm run lint
           npm run test-docker
 
+      - name: Test npx double-package install
+        run: |
+          npm pack --workspace packages/validator
+          npm pack --workspace packages/ruleset
+
+          # Test without a custom ruleset
+          npx --yes --prefer-online \
+            -p ./ibm-cloud-openapi-ruleset-*.tgz \
+            -p ./ibm-openapi-validator-*.tgz \
+            lint-openapi packages/validator/test/cli-validator/mock-files/oas3/clean.yml
+
+          # Test with a custom .spectral.js
+          printf "const ibmRuleset = require('@ibm-cloud/openapi-ruleset');\nmodule.exports = { extends: [[ibmRuleset, 'all']], rules: {} };\n" > /tmp/test-spectral.js
+
+          npx --yes --prefer-online \
+            -p ./ibm-cloud-openapi-ruleset-*.tgz \
+            -p ./ibm-openapi-validator-*.tgz \
+            lint-openapi --ruleset /tmp/test-spectral.js \
+            packages/validator/test/cli-validator/mock-files/oas3/clean.yml
+
   publish-release:
     needs: build
     name: semantic-release

package.json

@@ -49,9 +49,6 @@
     "proxy-agent": "6.3.0",
     "micromatch": "4.0.8",
     "jsonpath-plus": "10.3.0",
-    "rollup": "2.80.0",
-    "@stoplight/spectral-core": {
-      "minimatch": "3.1.5"
-    }
+    "rollup": "2.80.0"
   }
 }

packages/ruleset/package.json

@@ -24,7 +24,7 @@
     "@ibm-cloud/openapi-ruleset-utilities": "1.9.2",
     "@stoplight/spectral-formats": "1.8.2",
     "@stoplight/spectral-functions": "1.10.1",
-    "@stoplight/spectral-rulesets": "1.22.1",
+    "@stoplight/spectral-rulesets": "1.22.7",
     "chalk": "4.1.2",
     "inflected": "2.1.0",
     "jsonschema": "1.5.0",
@@ -35,7 +35,7 @@
     "validator": "13.15.23"
   },
   "devDependencies": {
-    "@stoplight/spectral-core": "1.21.0",
+    "@stoplight/spectral-core": "1.23.1",
     "jest": "29.7.0"
   },
   "engines": {

packages/utilities/package.json

@@ -22,7 +22,7 @@
     "pkg": "echo no executables to build in this package"
   },
   "devDependencies": {
-    "@stoplight/spectral-core": "1.21.0",
+    "@stoplight/spectral-core": "1.23.1",
     "jest": "29.7.0",
     "typescript": "5.8.3"
   },

packages/validator/package.json

@@ -26,7 +26,7 @@
     "@ibm-cloud/openapi-ruleset": "1.33.13",
     "@ibm-cloud/openapi-ruleset-utilities": "1.9.2",
     "@stoplight/spectral-cli": "6.15.0",
-    "@stoplight/spectral-core": "1.21.0",
+    "@stoplight/spectral-core": "1.23.1",
     "@stoplight/spectral-parsers": "1.0.5",
     "@stoplight/spectral-ref-resolver": "1.0.5",
     "ajv": "8.18.0",

packages/validator/test/cli-validator/tests/spectral-core-version-sync.test.js

@@ -0,0 +1,28 @@
+/**
+ * Copyright 2026 IBM Corporation.
+ * SPDX-License-Identifier: Apache2.0
+ */
+
+const semver = require('semver');
+
+const validatorPkg = require('../../../package.json');
+const rulesetPkg = require('../../../../ruleset/package.json');
+const spectralRulesetsPkg = require('@stoplight/spectral-rulesets/package.json');
+
+// The version of @stoplight/spectral-core declared in each package.json.
+// These must stay in sync to avoid an instanceof Ruleset mismatch.
+const validatorPin = validatorPkg.dependencies['@stoplight/spectral-core'];
+const rulesetDevPin = rulesetPkg.devDependencies['@stoplight/spectral-core'];
+const spectralRulesetsRange =
+  spectralRulesetsPkg.dependencies['@stoplight/spectral-core'];
+
+describe('spectral-core version sync', function () {
+  it('validator and ruleset devDependency should pin the same spectral-core version', function () {
+    expect(validatorPin).toEqual(rulesetDevPin);
+  });
+
+  it('validator spectral-core pin should satisfy the range required by spectral-rulesets', function () {
+    const satisfies = semver.satisfies(validatorPin, spectralRulesetsRange);
+    expect(satisfies).toBe(true);
+  });
+});