ci(workflow): pin Node in package.json devEngines instead of .nvmrc (SEC-104)

GL
2d ago
+9-3

What

  • Moves the exact Node pin (22.23.4) from .nvmrc to package.json devEngines.runtime and deletes .nvmrc.
  • Workflows now read it with node-version-file: package.json. setup-node v6.3 and later read devEngines.runtime before engines.node, so CI gets the exact version, not the newest match of the engines range.
  • onFail: "warn": npm warns on a mismatch instead of failing, so a local Node that is a patch behind is flagged without blocking work. CI stays exact through setup-node.

Why

One place for the Node version, read by CI and by the package manager. .nvmrc is only read by nvm and setup-node, and an engines range alone would let CI float to whatever release is newest. Docker base images are pinned separately and are unchanged.

Local verification

hub node=v22.23.4 pm=npm install=0 build=0 lint=0

Refs SEC-104. Requested by guillaume@stackone.com in Slack.

🤖 Generated with Claude Code

Summary by cubic

Moves the pinned Node version (22.23.4) from .nvmrc to package.json devEngines.runtime so the version has a single source of truth read by both npm and CI. .nvmrc is deleted and both workflows now point node-version-file at package.json; setup-node reads devEngines.runtime before engines.node, so CI installs the exact pinned version instead of the newest release matching the range. onFail: "warn" flags a patch-behind local Node as a warning without blocking work.