Ensure PR CI uses lockfile Node version and add automerge.

.github/workflows/auto-approve-merge-bot.yml

@@ -0,0 +1,88 @@
+name: Auto approve & merge Dependabot and Renovate PRs
+
+on:
+  pull_request:
+    types: [opened, edited, synchronize, reopened, labeled]
+    branches: [master]
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  auto-approve-merge:
+    runs-on: ubuntu-latest
+    if: >
+      github.event.pull_request.user.login == 'dependabot[bot]' ||
+      github.event.pull_request.user.login == 'dependabot' ||
+      github.event.pull_request.user.login == 'renovate[bot]' ||
+      github.event.pull_request.user.login == 'renovate'
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v7
+
+      - name: Auto approve PR
+        uses: hmarr/auto-approve-action@v3
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Fetch Dependabot metadata
+        if: github.event.pull_request.user.login == 'dependabot[bot]' || github.event.pull_request.user.login == 'dependabot'
+        id: metadata
+        uses: dependabot/fetch-metadata@v2
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Check if PR should be auto-merged
+        id: check_auto_merge
+        env:
+          UPDATE_TYPE: ${{ steps.metadata.outputs['update-type'] }}
+          ACTOR: ${{ github.event.pull_request.user.login }}
+          LABELS: ${{ toJson(github.event.pull_request.labels) }}
+        run: |
+          UPDATE_TYPE="${UPDATE_TYPE:-unknown}"
+
+          if [ "$ACTOR" == "dependabot[bot]" ] || [ "$ACTOR" == "dependabot" ]; then
+            if [[ "$UPDATE_TYPE" == "version-update:semver-patch" || "$UPDATE_TYPE" == "version-update:semver-minor" ]]; then
+              echo "auto_merge=true" >> $GITHUB_OUTPUT
+            else
+              echo "auto_merge=false" >> $GITHUB_OUTPUT
+            fi
+          elif [ "$ACTOR" == "renovate[bot]" ] || [ "$ACTOR" == "renovate" ]; then
+            LABEL_NAMES=$(echo "$LABELS" | jq -r '.[].name' | tr '\n' ' ')
+            if [[ "$LABEL_NAMES" == *"patch"* ]] || [[ "$LABEL_NAMES" == *"minor"* ]]; then
+              echo "auto_merge=true" >> $GITHUB_OUTPUT
+            else
+              echo "auto_merge=false" >> $GITHUB_OUTPUT
+            fi
+          else
+            echo "auto_merge=false" >> $GITHUB_OUTPUT
+          fi
+        shell: bash
+
+      - name: Wait for CI checks
+        if: steps.check_auto_merge.outputs.auto_merge == 'true'
+        timeout-minutes: 45
+        uses: lewagon/wait-on-check-action@v1.9.1
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+          repo-token: ${{ secrets.GITHUB_TOKEN }}
+          wait-interval: 30
+          running-workflow-name: 'auto-approve-merge'
+          ignore-checks: |
+            sync
+            renovate/artifacts
+
+      - name: Enable GitHub auto-merge
+        if: steps.check_auto_merge.outputs.auto_merge == 'true'
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+        run: |
+          echo "Enabling GitHub auto-merge for PR #$PR_NUMBER"
+          if gh pr merge --auto --merge "$PR_NUMBER"; then
+            echo "GitHub auto-merge enabled"
+            exit 0
+          fi
+          echo "Native auto-merge unavailable; merging after green CI"
+          gh pr merge --merge "$PR_NUMBER"

.github/workflows/deploy-pr-staging.yml

@@ -40,7 +40,7 @@ jobs:
           fi
 
       - name: ⬇️ Checkout application code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           ref: ${{ inputs.deploy_target == 'master' && 'master' || format('refs/pull/{0}/merge', inputs.pr_number) }}
 

.github/workflows/node.yml

@@ -1,46 +1,46 @@
 name: Node.js CI
 
-on: [push]
+on:
+  push:
+    branches: [master]
+  pull_request:
 
 jobs:
   build:
-
     runs-on: ubuntu-latest
-    container:
-      image: node:22-bookworm
-
-    strategy:
-      matrix:
-        node-version: [22.x]
 
     steps:
-      # Install essential packages first
-      - name: Install essential packages
-        run: |
-          apt-get update
-          apt-get install -y git curl xz-utils
-
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           persist-credentials: false
 
       - name: Reconfigure git to use HTTP authentication
         run: >
           git config --global url."https://github.com/".insteadOf ssh://git@github.com/
 
-      - name: Mark workspace as safe for git
-        run: |
-          git config --global --add safe.directory "$GITHUB_WORKSPACE"
-
-      - name: Use Node.js ${{ matrix.node-version }}
-        uses: actions/setup-node@v4
+      - name: Use Node.js from .nvmrc
+        uses: actions/setup-node@v7
         with:
-          node-version: ${{ matrix.node-version }}
+          node-version-file: '.nvmrc'
+          cache: 'npm'
 
-      - name: Install dependencies
+      - name: Verify dependencies match this PR lockfile
         run: |
-          npm ci
-          npm install @rollup/rollup-linux-x64-gnu
+          expected=$(grep -Eo '[0-9]+' .nvmrc | head -1)
+          actual=$(node -p "process.versions.node.split('.')[0]")
+          echo "Node from .nvmrc: $expected"
+          echo "Installed Node major: $actual"
+          test "$actual" = "$expected"
+          npm ci --include=optional
+          ROLLUP_LINUX=$(node -p "require('./node_modules/rollup/package.json').optionalDependencies['@rollup/rollup-linux-x64-gnu']")
+          npm install --no-save --no-package-lock "@rollup/rollup-linux-x64-gnu@${ROLLUP_LINUX}"
+          echo "Installed packages from this PR package-lock.json:"
+          npm ls --depth=0 --omit=dev || true
+          if [ "${{ github.event_name }}" = "pull_request" ]; then
+            git fetch --depth=1 origin "${{ github.base_ref }}"
+            echo "package-lock.json changes vs ${{ github.base_ref }}:"
+            git diff "origin/${{ github.base_ref }}" -- package-lock.json package.json || true
+          fi
 
       - run: npm run build
 
@@ -51,15 +51,15 @@ jobs:
           VITE_SERVER_PORT: 5000
           API_HOST: https://testrant.internet.ee
           PUBLIC_API_HOST: https://www.internet.ee
-          PUBLIC_API_KEY: 4395743059dsfksdfyds8f7334
+          PUBLIC_API_KEY: ${{ secrets.PUBLIC_API_KEY }}
           CLIENT_ID: eis_client_test
-          CLIENT_SECRET: secret12345
+          CLIENT_SECRET: ${{ secrets.CLIENT_SECRET }}
           ISSUER_URL: https://tara-test.ria.ee
           TOKEN_PATH: /oidc/token
           JWKS_PATH: /oidc/jwks
           AUTH_PATH: /oidc/authorize
           REDIRECT_URL: /auth/callback
-          SESSION_SECRET: secret555555
+          SESSION_SECRET: ${{ secrets.SESSION_SECRET }}
           HTTPS: true
         run: npm run coverage -- --coverage.reporter=lcov
 

.nvmrc

@@ -0,0 +1 @@
+22