From efc77099ebe3ac9b1af4c27fcecac5fba062eb59 Mon Sep 17 00:00:00 2001
From: Vector <vzhelev@vectorworks.net>
Date: Mon, 14 Sep 2026 10:56:37 +0000
Subject: [PATCH] ci: bump actions to node24-compatible versions, use npm ci in
 release, audit prod deps in test

---
 .github/actions/build-lib/action.yml     | 2 +-
 .github/actions/build-windows/action.yml | 2 +-
 .github/actions/release-as/action.yml    | 2 +-
 .github/workflows/artifact.yml           | 4 ++--
 .github/workflows/release.yml            | 6 +++---
 .github/workflows/test.yml               | 8 +++++++-
 6 files changed, 15 insertions(+), 9 deletions(-)

diff --git a/.github/actions/build-lib/action.yml b/.github/actions/build-lib/action.yml
index a4a9b913..04d5a52a 100644
--- a/.github/actions/build-lib/action.yml
+++ b/.github/actions/build-lib/action.yml
@@ -3,7 +3,7 @@ description: Build for the current OS
 runs:
   using: composite
   steps:
-    - uses: actions/setup-node@v4
+    - uses: actions/setup-node@v6
       with:
         node-version: 20
         registry-url: "https://npm.pkg.github.com"
diff --git a/.github/actions/build-windows/action.yml b/.github/actions/build-windows/action.yml
index a3f23e8e..d2491eca 100644
--- a/.github/actions/build-windows/action.yml
+++ b/.github/actions/build-windows/action.yml
@@ -78,7 +78,7 @@ runs:
     # --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
     # libMVRGdtf - setup
     - name: libMVRGdtf - checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@v5
       with:
         path: libMvrGdtf
 
diff --git a/.github/actions/release-as/action.yml b/.github/actions/release-as/action.yml
index 612bd38c..f2a8fc18 100644
--- a/.github/actions/release-as/action.yml
+++ b/.github/actions/release-as/action.yml
@@ -25,7 +25,7 @@ runs:
         git config --global user.email "simorolev@gmail.com"
         git config --global user.name "Simeon Rolev"
 
-    - uses: actions/setup-node@v4
+    - uses: actions/setup-node@v6
       with:
         node-version: 20
         registry-url: "https://npm.pkg.github.com"
diff --git a/.github/workflows/artifact.yml b/.github/workflows/artifact.yml
index 8a9083e8..a0cc1ebf 100644
--- a/.github/workflows/artifact.yml
+++ b/.github/workflows/artifact.yml
@@ -18,7 +18,7 @@ jobs:
     name: Export artifact for ${{ inputs.runner }}
     steps:
       - name: libMVRGdtf - checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           path: libMvrGdtf
       
@@ -26,7 +26,7 @@ jobs:
         uses: ./libMvrGdtf/.github/actions/build-lib
         
       - name: Upload artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v6
         with:
           name: libMVRgdtf-${{ inputs.runner }}
           path: |
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index e9906a60..0c598e4a 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -25,7 +25,7 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
       - name: Checkout repository under ./libMvrGdtf
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           path: libMvrGdtf
           ref: ${{ inputs.ref }}
@@ -45,7 +45,7 @@ jobs:
           git status -sb
 
       - name: Use Node.js 20.x
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
           node-version: 20
           registry-url: https://npm.pkg.github.com/
@@ -60,7 +60,7 @@ jobs:
           NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         working-directory: libMvrGdtf
         run: |
-          npm install
+          npm ci
           git config user.email "auto-release-bot@mvrdevelopment.com"
           git config user.name "Auto release bot"
 
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 74d8f75c..ebd13779 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -8,13 +8,19 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: libMVRGdtf - checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           path: libMvrGdtf
 
       - name: Build
         uses: ./libMvrGdtf/.github/actions/build-lib
 
+      - name: Audit production dependencies
+        working-directory: libMvrGdtf
+        run: |
+          npm ci
+          npm audit --omit=dev
+
       - name: Testing...
         working-directory: libMvrGdtf/build
         run: |