Repository navigation
ci(SEC-104): read the Node version from package.json in workflows - #35
Conversation
Workflows pinned Node separately from the repo's own version source, so every Node bump had to be made twice. setup-node now reads node-version-file: package.json, which makes package.json the only place to change. - .github/workflows/release.yml: 1 step (was 22.23.4). Requested by guillaume@stackone.com in Slack. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
There was a problem hiding this comment.
Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota.
An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing. Review the Copilot code review billing settings.
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
No issues found across 2 files
Confidence score: 5/5
- Automated review surfaced no issues in the provided summaries.
- No files require special attention.
Auto-approved: CI workflows now source the Node version from package.json instead of duplicating hardcoded values, removing the single-version matrix. This is a bounded, development-only configuration change with no product or runtime impact.
View guided diff | Turn on auto-fix | Re-trigger cubic
Summary
Every
actions/setup-nodestep now readsnode-version-file: package.jsoninstead of a hardcodednode-version.volta.nodeinpackage.jsonbecomes the only place that sets the Node version for CI and local development (currently 22.23.4).Why
SEC-104 (CVE-2026-111497) needed every Node bump to be made twice, once in the app's version source and once in each workflow, and some workflows were missed. With one source, the next bump is a one-line change.
Changes
.github/workflows/release.yml: 1 step (was22.23.4).Checks
node-version-filetarget exists at the path the job checks the repo out to..github/workflows/build.yml:14 expression ${{matrix.node-version}}.Dockerfile base images are not touched. They are pinned by digest, so they still need their own bump.
Requested by guillaume@stackone.com in Slack.
🤖 Generated with Claude Code