release: v4.21.1 - bake Node.js LTS into the cldmv-runners image

images/actions-runner/Dockerfile

@@ -1,12 +1,15 @@
-# CLDMV self-hosted runner image = the official ARC runner + gh CLI + jq.
+# CLDMV self-hosted runner image = the official ARC runner + gh CLI + jq + Node.js.
 #
 # The stock ghcr.io/actions/actions-runner image is deliberately minimal and
-# ships no gh or jq, unlike GitHub's hosted ubuntu-latest. Once v4.19.1 routed
-# private CLDMV CI to these self-hosted cldmv-runners, every reusable job that
-# shells out to gh started failing with exit 127 (gh: command not found). This
-# image adds gh (and jq, which hosted runners also preinstall and workflow run
-# steps reasonably assume) so those jobs run on self-hosted exactly as they did
-# on hosted. See #210.
+# ships no gh, jq, or node, unlike GitHub's hosted ubuntu-latest. Once v4.19.1
+# routed private CLDMV CI to these self-hosted cldmv-runners, every reusable job
+# that shells out to gh started failing with exit 127 (gh: command not found),
+# and run steps invoking node/npm directly hit the same gap. This image adds gh,
+# jq, and Node.js (current LTS — all preinstalled on hosted runners and
+# reasonably assumed by workflow run steps) so those jobs run on self-hosted
+# exactly as they did on hosted. Jobs that need a specific Node version still
+# use actions/setup-node, which prepends its own toolcache copy to PATH; the
+# baked-in LTS is only the default, matching hosted-runner behavior. See #210.
 #
 # Nothing sensitive is baked in: this is the public base image plus the gh binary
 # from GitHub's public apt repo. Runner auth (the GitHub App) lives in the
@@ -15,7 +18,7 @@
 FROM ghcr.io/actions/actions-runner:latest
 
 LABEL org.opencontainers.image.source="https://github.com/CLDMV/.github"
-LABEL org.opencontainers.image.description="ARC actions-runner + gh CLI for CLDMV self-hosted cldmv-runners"
+LABEL org.opencontainers.image.description="ARC actions-runner + gh, jq, Node.js LTS for CLDMV self-hosted cldmv-runners"
 LABEL org.opencontainers.image.licenses="Apache-2.0"
 
 # Package installs need root; the base runs as the non-root `runner` user.
@@ -34,10 +37,18 @@ RUN apt-get update \
  && apt-get install -y --no-install-recommends gh jq \
  && rm -rf /var/lib/apt/lists/*
 
+# Node.js current LTS via NodeSource's lts channel (includes npm/npx). The
+# channel resolves to whatever the active LTS major is at build time, so the
+# weekly rebuild tracks LTS promotions and security releases without a version
+# baked into this file.
+RUN curl -fsSL https://deb.nodesource.com/setup_lts.x | bash - \
+ && apt-get install -y --no-install-recommends nodejs \
+ && rm -rf /var/lib/apt/lists/*
+
 # Add further hosted-runner tools here as #210's audit surfaces them.
 
 # Back to the runner user the entrypoint expects.
 USER runner
 
-# Build-time gate: fail the build if gh or jq isn't on PATH.
-RUN gh --version && jq --version
+# Build-time gate: fail the build if any expected tool isn't on PATH.
+RUN gh --version && jq --version && node --version && npm --version

package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@cldmv/.github",
-	"version": "4.21.0",
+	"version": "4.21.1",
 	"description": "Shared GitHub Actions, reusable workflows, and org-wide tooling for the CLDMV organization.",
 	"author": {
 		"name": "Shinrai",