ci(SEC-104): read the Node version from .nvmrc in workflows

Merged
GL
11d ago
+4-3

Summary

Every actions/setup-node step now reads node-version-file: .nvmrc instead of a hardcoded node-version. .nvmrc becomes the only place that sets the Node version for CI and local development (currently 22.23.4).

Why

SEC-104 (CVE-2026-111497) needed every Node bump to be made twice, once in the app's version source and once in each workflow, and some workflows were missed. With one source, the next bump is a one-line change.

Changes

  • Add .nvmrc with 22.23.4.
  • .github/workflows/validate.yml: 3 steps (was 22).
  • 3 steps were on a floating or outdated pin and now run the exact version above.

Checks

  • Every changed workflow and action still parses as YAML.
  • Every node-version-file target exists at the path the job checks the repo out to.

Dockerfile base images are not touched. They are pinned by digest, so they still need their own bump.

Requested by guillaume@stackone.com in Slack.

šŸ¤– Generated with Claude Code