[kac-axelor]

Summary

Upgrade all GitHub Actions to their latest majors, deduplicate the pnpm/Node setup into a composite action, replace a deprecated action, and align engines.node with what CI actually exercises.

Changes

Action upgrades

• actions/checkout: v3 → v6
• actions/setup-node: v3 → v6 (Node 18 → 22.x)
• pnpm/action-setup: v3 → v6 (drops version: latest; reads pnpm version from packageManager in package.json)
• docker/setup-docker-action: v4 → v5
• actions/create-release@v1 (archived/deprecated) → softprops/action-gh-release@v3

Workflow refactor

• Extract repeated pnpm + Node + install steps into .github/actions/setup composite action. Avoids the partial-upgrade asymmetry flagged in earlier review and removes 4× duplication.
• Add permissions: contents: write on the release job (required by softprops/action-gh-release).

Engines

• Bump engines.node from >=18.18.0 to >=22.11.0 so the declared minimum matches CI. 22.11.0 is the first LTS release of the v22 line.

Test plan

• build, test, test-e2e jobs green on this PR
• Verify publish-next runs cleanly on merge to dev
• Verify publish runs cleanly on next tag push (release creation now via softprops/action-gh-release)

[ame-axelor]

The upgraded jobs look correct — step reordering for cache: "pnpm" is right, and dropping version: latest is fine since package.json pins packageManager: pnpm@10.19.0. CI is green on build/test/test-e2e. A few things to address before merge though:

1. Partial upgrade — please finish the job. The PR title says "v6" but publish-next and publish are still on actions/checkout@v3, actions/setup-node@v3, and pnpm/action-setup@v3 (lines ~71-80 and ~111-118 of .github/workflows/gradle.yml). Only node-version was bumped there. Two problems:

   • The file now has the same setup pattern in two different versions side-by-side — confusing for future readers.
   • Those jobs only run on push to dev or on tag push, so they show as skipping in this PR's checks. The v3-actions-with-Node-22 combo is not actually exercised by CI here, and any incompatibility will only surface after merge.

   Please upgrade them to @v6 and add cache: "pnpm" for consistency.

2. engines.node mismatch. package.json still declares "node": ">=18.18.0" while CI now only tests on Node 22. Either keep Node 18 in the matrix or bump engines.node so consumers don't install on a version we no longer test.

3. (Optional) actions/create-release@v1 is archived (line ~105). Not introduced by this PR but right next to lines you're touching — worth replacing with softprops/action-gh-release or a gh release create step in a follow-up.

4. (Optional) DRY the setup. All five jobs duplicate the same checkout + setup-node + pnpm-setup + install block. A composite action under .github/actions/setup/ would collapse them and prevent partial-upgrade asymmetry like the one above. Out of scope for this PR, but if you're touching every job anyway, it's a cheap follow-up.

Items 1 and 2 are the blockers; 3 and 4 are nice-to-haves. Happy to approve once the publish jobs are aligned.

[kac-axelor]

All issues addressed. Please let me know if further changes required

[ame-axelor]

All blockers addressed and both optional follow-ups landed too — composite action extracted, actions/create-release swapped for softprops/action-gh-release, engines.node aligned, plus docker/setup-docker-action bumped. CI is green on build/test/test-e2e.

Note for after merge: the engines bump to >=22.11.0 is consumer-visible — worth flagging in the changelog and bumping the package minor. The new release flow (npm publish → GitHub release via softprops) will be exercised for the first time on the next tag push; worth a watchful eye.