Repository navigation
ci(SEC-104): read the Node version from .nvmrc in workflows - #7
Conversation
Workflows pinned Node separately from the repo's own version source, so every Node bump had to be made twice. setup-node now reads node-version-file: .nvmrc, which makes .nvmrc the only place to change. - Add .nvmrc with 22.23.4. - .github/workflows/validate.yml: 3 steps (was 22). - 3 steps were on a floating or outdated pin and now run the exact version above. Requested by guillaume@stackone.com in Slack. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
There was a problem hiding this comment.
Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota.
An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing. Review the Copilot code review billing settings.
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
No issues found across 2 files
Confidence score: 5/5
- Automated review surfaced no issues in the provided summaries.
- No files require special attention.
Auto-approved: CI-only change that adds .nvmrc and makes three setup-node steps read the Node version from it instead of the floating major 22, pinning to exact 22.23.4. This creates a single source of truth for the Node version, is easily reversible, and has no product or operational impact.
View guided diff | Turn on auto-fix | Re-trigger cubic
Summary
Every
actions/setup-nodestep now readsnode-version-file: .nvmrcinstead of a hardcodednode-version..nvmrcbecomes the only place that sets the Node version for CI and local development (currently 22.23.4).Why
SEC-104 (CVE-2026-111497) needed every Node bump to be made twice, once in the app's version source and once in each workflow, and some workflows were missed. With one source, the next bump is a one-line change.
Changes
.nvmrcwith22.23.4..github/workflows/validate.yml: 3 steps (was22).Checks
node-version-filetarget exists at the path the job checks the repo out to.Dockerfile base images are not touched. They are pinned by digest, so they still need their own bump.
Requested by guillaume@stackone.com in Slack.
🤖 Generated with Claude Code