fix(retention): enforce Node 22 operator runtime

QN
12h ago
+196-9

User description

Summary

  • Require the retention operator process to run Node 22.19.0 or later in the 22.x line before argument handling, source checks, child processes, provider calls, runner imports, or lock acquisition.
  • Keep the application Node 22/24 CI matrix and package engine range unchanged.
  • Add subprocess regressions that prove unsupported and malformed runtimes stop with zero external CLI, provider, runner-import, or lock calls; run the suite through the existing Vitest wrapper on both supported CI matrix versions.

Evidence

  • Retention suites: 179/179 pass under Node 22.23.3 and 24.18.0.
  • Targeted Vitest wrapper passes under Node 22.23.3 and 24.18.0.
  • ci:prepush passes on the signed branch commit; change classification was conservative AMBIGUOUS, so the full local admission checks ran.
  • Owner maintenance authorization is recorded in #627 comment 6238132825.

Merge conditions

Merge only after current required checks, the repository's three review channels, and all security checks pass on the exact PR head. This change does not remediate the existing ZIP OSV findings.

Summary by Sourcery

Require the Vercel retention operator to run on a supported Node 22 runtime before performing any retention work.

Bug Fixes:

  • Enforce Node 22.19.0 or later in the 22.x line before retention operations can handle arguments, access sources or providers, import runners, or acquire locks.

Enhancements:

  • Document the retention operator runtime contract, refusal behavior, and verification guidance while keeping the application engine range and Node 22/24 CI matrix unchanged.

Documentation:

  • Document the required Node 22.19.0+ retention runtime and the new runtime-mismatch stop reason.

Tests:

  • Add runtime validation and subprocess regressions confirming unsupported or malformed runtimes produce no external CLI, provider, runner-import, or lock calls across dry-run and reconcile modes.

Chores:

  • Record the retention runtime requirement in the changelog.

Summary by cubic

Enforces the Vercel retention operator's Node 22.19.0+ runtime requirement. The operator now validates process.versions.node at entry and stops with RETENTION_STOP: runtime-mismatch on unsupported or malformed runtimes before argument handling, source checks, provider calls, runner imports, or lock acquisition, with no override.

Behavior

  • The application's Node 22/24 CI matrix and package engine range are unchanged.
  • Behavior tests stub the runtime so supported-runtime fixtures run under both CI matrix versions, and reconcile tests assert the exact deleted deployment IDs.
  • Adds subprocess regressions proving unsupported runtimes make zero external CLI, provider, runner-import, or lock calls.
  • Documents the runtime contract, the new stop reason, and runtime verification guidance, and records it in the changelog.

CodeAnt-AI Description

Require Node 22.19 or later for retention operations

What Changed

  • Retention dry runs and reconciliations now stop with a runtime mismatch on unsupported or malformed Node versions, including Node 24.
  • The runtime check happens before source checks, provider calls, external tools, runner imports, or lock acquisition.
  • Document the runtime requirement and refusal behavior; the application’s Node 22/24 CI matrix and package engine range remain unchanged.

Impact

✅ No provider calls or locks on unsupported Node runtimes
✅ Clear Node 22.19+ requirement for retention operators
✅ Node 24 remains supported for the application

💡 Usage Guide

Checking Your Pull Request

Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.

Talking to CodeAnt AI

Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:

@codeant-ai ask: Your question here

This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.

Example

@codeant-ai ask: Can you suggest a safer alternative to storing this secret?

Preserve Org Learnings with CodeAnt

You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:

@codeant-ai: Your feedback here

This helps CodeAnt AI learn and adapt to your team's coding style and standards.

Example

@codeant-ai: Do not flag unused imports.

Retrigger review

Ask CodeAnt AI to review the PR again, by typing:

@codeant-ai: review

Check Your Repository Health

To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.

Summary by CodeRabbit

  • Bug Fixes
    • The retention runner now stops with a clear runtime-mismatch reason on unsupported or malformed Node versions, before source checks, imports, external calls, or lock acquisition.
    • The runner requires Node 22.19.0 or later within the 22.x line; the application’s existing Node support remains unchanged.
  • Documentation
    • Updated runner guidance to explain the runtime requirement, affected entry points, and early-stop behavior.