From d818657f0173b792e372456449eac00449af9c4f Mon Sep 17 00:00:00 2001 From: samyakLambda Date: Thu, 29 Oct 2026 17:51:45 +0530 Subject: [PATCH 1/2] Pick up patched Node in CI with setup-node check-latest setup-node reuses the Node a runner already caches for the requested line, so a job can keep running an older patch after a Node security release. check-latest resolves the newest release of the line instead. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/industry-rook-ci.yml | 1 + .github/workflows/publish-skill.yml | 1 + .github/workflows/test-samples.yml | 2 ++ .github/workflows/test-scripts.yml | 2 ++ 4 files changed, 6 insertions(+) diff --git a/.github/workflows/industry-rook-ci.yml b/.github/workflows/industry-rook-ci.yml index 9f0c050..4b25704 100644 --- a/.github/workflows/industry-rook-ci.yml +++ b/.github/workflows/industry-rook-ci.yml @@ -31,6 +31,7 @@ jobs: - uses: actions/setup-node@v7.0.0 with: node-version: 22 + check-latest: true - name: Install the published Rook CLI run: npm install -g @testmuai/rook@latest - run: npm ci diff --git a/.github/workflows/publish-skill.yml b/.github/workflows/publish-skill.yml index 42c3eac..6d5d9b6 100644 --- a/.github/workflows/publish-skill.yml +++ b/.github/workflows/publish-skill.yml @@ -26,6 +26,7 @@ jobs: - uses: actions/setup-node@v7.0.0 with: node-version: '22' + check-latest: true registry-url: https://registry.npmjs.org - name: Validate release input env: diff --git a/.github/workflows/test-samples.yml b/.github/workflows/test-samples.yml index 967d4a5..4d31af4 100644 --- a/.github/workflows/test-samples.yml +++ b/.github/workflows/test-samples.yml @@ -27,6 +27,7 @@ jobs: - uses: actions/setup-node@v7.0.0 with: node-version: "22" + check-latest: true # `node --test` discovers every test/*.test.mjs file, so a new test file # joins without editing package.json or this workflow. - run: npm test @@ -45,6 +46,7 @@ jobs: - uses: actions/setup-node@v7.0.0 with: node-version: "22" + check-latest: true - run: npm ci - run: npm run setup - run: npm test diff --git a/.github/workflows/test-scripts.yml b/.github/workflows/test-scripts.yml index 8955f95..2216119 100644 --- a/.github/workflows/test-scripts.yml +++ b/.github/workflows/test-scripts.yml @@ -21,6 +21,7 @@ jobs: - uses: actions/setup-node@v4 with: node-version: "22" + check-latest: true # Detect command drift against the current published CLI. - name: Install the current rook @@ -59,4 +60,5 @@ jobs: - uses: actions/setup-node@v7.0.0 with: node-version: '22' + check-latest: true - run: bash scripts/test-skill-installer.sh From 0a552676cb1c8533aed8f60a44d9ee141f62b07a Mon Sep 17 00:00:00 2001 From: samyakLambda Date: Thu, 29 Oct 2026 18:07:35 +0530 Subject: [PATCH 2/2] Pin Node 22.23.4 instead of check-latest Use the exact October 2026 security release the org advisory lists, not whatever the newest Node 22 is when a job runs. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/industry-rook-ci.yml | 3 +-- .github/workflows/publish-skill.yml | 3 +-- .github/workflows/test-samples.yml | 6 ++---- .github/workflows/test-scripts.yml | 6 ++---- 4 files changed, 6 insertions(+), 12 deletions(-) diff --git a/.github/workflows/industry-rook-ci.yml b/.github/workflows/industry-rook-ci.yml index 4b25704..5bfa75c 100644 --- a/.github/workflows/industry-rook-ci.yml +++ b/.github/workflows/industry-rook-ci.yml @@ -30,8 +30,7 @@ jobs: persist-credentials: false - uses: actions/setup-node@v7.0.0 with: - node-version: 22 - check-latest: true + node-version: 22.23.4 - name: Install the published Rook CLI run: npm install -g @testmuai/rook@latest - run: npm ci diff --git a/.github/workflows/publish-skill.yml b/.github/workflows/publish-skill.yml index 6d5d9b6..ed52c05 100644 --- a/.github/workflows/publish-skill.yml +++ b/.github/workflows/publish-skill.yml @@ -25,8 +25,7 @@ jobs: persist-credentials: false - uses: actions/setup-node@v7.0.0 with: - node-version: '22' - check-latest: true + node-version: '22.23.4' registry-url: https://registry.npmjs.org - name: Validate release input env: diff --git a/.github/workflows/test-samples.yml b/.github/workflows/test-samples.yml index 4d31af4..ddb6437 100644 --- a/.github/workflows/test-samples.yml +++ b/.github/workflows/test-samples.yml @@ -26,8 +26,7 @@ jobs: persist-credentials: false - uses: actions/setup-node@v7.0.0 with: - node-version: "22" - check-latest: true + node-version: "22.23.4" # `node --test` discovers every test/*.test.mjs file, so a new test file # joins without editing package.json or this workflow. - run: npm test @@ -45,8 +44,7 @@ jobs: persist-credentials: false - uses: actions/setup-node@v7.0.0 with: - node-version: "22" - check-latest: true + node-version: "22.23.4" - run: npm ci - run: npm run setup - run: npm test diff --git a/.github/workflows/test-scripts.yml b/.github/workflows/test-scripts.yml index 2216119..df53030 100644 --- a/.github/workflows/test-scripts.yml +++ b/.github/workflows/test-scripts.yml @@ -20,8 +20,7 @@ jobs: - uses: actions/setup-node@v4 with: - node-version: "22" - check-latest: true + node-version: "22.23.4" # Detect command drift against the current published CLI. - name: Install the current rook @@ -59,6 +58,5 @@ jobs: persist-credentials: false - uses: actions/setup-node@v7.0.0 with: - node-version: '22' - check-latest: true + node-version: '22.23.4' - run: bash scripts/test-skill-installer.sh