From a1cd3490cab94c4dfc0a36a0a43f3e0901ec9851 Mon Sep 17 00:00:00 2001 From: iliya Date: Sat, 19 Sep 2026 16:03:43 +0300 Subject: [PATCH] fix(release): pin Node 22.21.1 for agentplugins release validation Unpinned Node 22 floated to 22.23.2, so npm qualification refused the release job while required CI still ran the exact 22.21.1 pin. --- .github/workflows/agentplugins-release.yml | 6 +++--- .../cmd/agentplugins/release_workflow_test.go | 7 +++++++ 2 files changed, 10 insertions(+), 3 deletions(-) diff --git a/.github/workflows/agentplugins-release.yml b/.github/workflows/agentplugins-release.yml index e2eb6797..e78daa9d 100644 --- a/.github/workflows/agentplugins-release.yml +++ b/.github/workflows/agentplugins-release.yml @@ -132,7 +132,7 @@ jobs: run: go test ./cmd/agentplugins -run '^TestReleaseBuiltBinaryHasNoConformanceEnvironmentOverride$' -count=1 - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: - node-version: 22 + node-version: "22.21.1" package-manager-cache: false - name: Test npm bootstrap without install scripts working-directory: npm/agentplugins @@ -345,7 +345,7 @@ jobs: ref: ${{ needs.validate.outputs.commit }} - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: - node-version: 22 + node-version: "22.21.1" package-manager-cache: false - name: Verify live draft after successful platform proofs env: @@ -383,7 +383,7 @@ jobs: ref: ${{ needs.validate.outputs.commit }} - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: - node-version: 22 + node-version: "22.21.1" package-manager-cache: false - name: Reverify exact draft and promote only after all native proofs env: diff --git a/cli/plugin-kit-ai/cmd/agentplugins/release_workflow_test.go b/cli/plugin-kit-ai/cmd/agentplugins/release_workflow_test.go index 6e9456c8..05fdb96c 100644 --- a/cli/plugin-kit-ai/cmd/agentplugins/release_workflow_test.go +++ b/cli/plugin-kit-ai/cmd/agentplugins/release_workflow_test.go @@ -34,6 +34,7 @@ func TestStableReleaseRequiresVerifiedReproducibleBootstrapBeforeBuild(t *testin } for _, required := range []string{ "go-version: 1.25.13", + "node-version: \"22.21.1\"", "GOWORK: \"off\"", "GOTOOLCHAIN: local", "GOFLAGS: -buildvcs=false -p=1", @@ -56,6 +57,12 @@ func TestStableReleaseRequiresVerifiedReproducibleBootstrapBeforeBuild(t *testin t.Fatalf("agentplugins stable release lacks %q", required) } } + if strings.Count(workflow, "node-version: \"22.21.1\"") != 3 { + t.Fatal("agentplugins stable release must pin Node 22.21.1 on validate, verified-draft, and promote") + } + if strings.Contains(workflow, "node-version: 22\n") || strings.Contains(workflow, "node-version: 22\r") { + t.Fatal("agentplugins stable release must not use an unpinned Node 22") + } negativeTestIndex := strings.Index(workflow, "TestReleaseBuiltBinaryHasNoConformanceEnvironmentOverride") if negativeTestIndex < 0 || negativeTestIndex > buildIndex { t.Fatal("negative release-binary conformance test must run in validate before release builds")