Repository navigation
fix(ci): use Node 22.23.4 for installed-Pi checks - #680
Merged
Merged
Conversation
monit-reviewer
approved these changes
Oct 21, 2026
monit-reviewer
left a comment
monit-reviewer
left a comment
There was a problem hiding this comment.
Automated PR Review
Reviewed commit: 62f8663f06b2
Profile: pi-codex-monit-reviewer - Posting as: monit-reviewer
Summary
| Reviewer | Findings |
|---|---|
| automation:ci-release | 0 |
Reviewer Coverage
Complete coverage details are retained in the local coverage.json artifact.
automation:ci-release— complete (broad); scope: 1 file; examples:.github/workflows/ci.yml; body-inspected: 1 file; examples:.github/workflows/ci.yml; skipped: none; context (not coverage): 1 file; examples:Makefile; constraints: Static review only; CI execution and external Node release availability were not independently verified.
0 PR discussion threads considered. 0 summarized; 0 resolved.
Completed in 34s | $0.03 | openai-codex/gpt-6.1-sol | cr 0.10.342
| Field | Value |
|---|---|
| Model | openai-codex/gpt-6.1-sol |
| Reviewers | automation:ci-release |
| Engine | pi_rpc · openai-codex/gpt-6.1-sol |
| Reviewed by | cr · monit-reviewer |
| Duration | 34s wall · 22s compute |
| Cost | $0.03 |
| Tokens | 11.4k in / 418 out |
Per-workstream usage
orchestrator-selection— openai-codex/gpt-6.1-sol- In: 4.3k
- Out: 233
- Cache read: 0
- Cache create: 0
- Cost: $0.01
- Duration: 10s
automation:ci-release— openai-codex/gpt-6.1-sol- In: 6.4k
- Out: 135
- Cache read: 7.2k
- Cache create: 0
- Cost: $0.01
- Duration: 8s
orchestrator-rollup— openai-codex/gpt-6.1-sol- In: 704
- Out: 50
- Cache read: 0
- Cache create: 0
- Cost: $0.00
- Duration: 3s
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The installed-Pi CI job pins Node 22.22.3, which predates the October security release. Use Node 22.23.4 so its TLS verifier blocks the affected eMudhra public keys. This preserves Node 22 and the existing Pi installation and test workflow.
Verification on macOS ARM64: actionlint passed for
ci.yml; the CI installation of Pi 1.0.0 andmake test-pi-runtimepassed with Node 22.23.4, including the race-enabled installed-Pi tests. Pi was installed in an isolated prefix to preserve the workstation's existing installation.git diff --checkpassed.The official Node 22.23.4 release notes document the updated certificate bundle and blocked-public-key certificate checks. This changes the CI runtime; existing application releases require no rebuild for this workflow-only pin.