ci(SEC-104): read the Node version from package.json in workflows

Merged
GL
9d ago
+3-6

Summary

Every actions/setup-node step now reads node-version-file: package.json instead of a hardcoded node-version. volta.node in package.json becomes the only place that sets the Node version for CI and local development (currently 22.23.4).

Why

SEC-104 (CVE-2026-111497) needed every Node bump to be made twice, once in the app's version source and once in each workflow, and some workflows were missed. With one source, the next bump is a one-line change.

Changes

  • .github/workflows/release.yml: 1 step (was 22.23.4).

Checks

  • Every changed workflow and action still parses as YAML.
  • Every node-version-file target exists at the path the job checks the repo out to.
  • Left as is: .github/workflows/build.yml:14 expression ${{matrix.node-version}}.

Dockerfile base images are not touched. They are pinned by digest, so they still need their own bump.

Requested by guillaume@stackone.com in Slack.

šŸ¤– Generated with Claude Code