From 5ac3b7e449a709fda7cc677c889edf0e9cb43f45 Mon Sep 17 00:00:00 2001
From: rogerjeasy <rogerjeasy@gmail.com>
Date: Sun, 23 Aug 2026 21:40:42 +0200
Subject: [PATCH 1/2] ci: run the test suite on Node 20, 22 and 24

The repo had no CI, so nothing checked the `engines: >=20` promise while
development happens on v24.

Deliberately not the stock GitHub Node template: that runs `npm ci` and caches
on a lockfile, and this plugin has zero runtime dependencies, so there is no
lockfile and `npm ci` would fail on the first step. With no install step needed
the job is checkout, setup-node, `npm test`.

fail-fast is off so a break on the floor version still reports the others.

Verified locally before pushing: 344/344 on v20.20.2, v22.23.2 and v24.19.0.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 .github/workflows/test.yml | 41 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 41 insertions(+)
 create mode 100644 .github/workflows/test.yml

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
new file mode 100644
index 0000000..974ab9e
--- /dev/null
+++ b/.github/workflows/test.yml
@@ -0,0 +1,41 @@
+name: test
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+# The suite only ever reads the checkout; nothing needs write access.
+permissions:
+  contents: read
+
+# A new push to the same branch makes the in-flight run irrelevant.
+concurrency:
+  group: test-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        # 20 is the floor declared in package.json engines; 24 is what
+        # development happens on. Both ends get checked, not just one.
+        node: ['20', '22', '24']
+
+    name: node ${{ matrix.node }}
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: ${{ matrix.node }}
+          # No `cache: npm` on purpose: caching keys off a lockfile, and this
+          # plugin has zero runtime dependencies, so there is no lockfile and
+          # nothing to restore.
+
+      # No install step for the same reason. `npm ci` would fail outright
+      # without a lockfile. The suite is `node --test` over the repo as-is.
+      - run: npm test

From 3c175db02776a6fd1f2189b72e35e5684da30f9f Mon Sep 17 00:00:00 2001
From: rogerjeasy <rogerjeasy@gmail.com>
Date: Sun, 23 Aug 2026 21:44:31 +0200
Subject: [PATCH 2/2] ci: bump checkout and setup-node off the deprecated Node
 20 runtime
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The first run warned three times that actions/checkout@v4 and
actions/setup-node@v4 target Node 20, which GitHub deprecated for the action
runtime and now force-runs on Node 24. This is about the runtime executing the
action code, not the matrix — the Node 20 leg stays, since >=20 is the engines
floor this repo promises.

v5 and up target node24 and clear the warning; both are taken to the current
major.

setup-node v5 made caching automatic, which would have broken a repo with no
lockfile. v6 narrowed that to fire only when package.json declares a
`packageManager` field, and this one does not, so the bump is safe as-is.
Setting package-manager-cache: false anyway, so adding that field later cannot
silently reintroduce a cache step with no lockfile to key on.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 .github/workflows/test.yml | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 974ab9e..bb7f649 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -27,14 +27,17 @@ jobs:
     name: node ${{ matrix.node }}
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v7
         with:
           node-version: ${{ matrix.node }}
-          # No `cache: npm` on purpose: caching keys off a lockfile, and this
-          # plugin has zero runtime dependencies, so there is no lockfile and
-          # nothing to restore.
+          # Caching keys off a lockfile, and this plugin has zero runtime
+          # dependencies, so there is no lockfile and nothing to restore.
+          # setup-node >=6 only auto-caches when package.json declares a
+          # `packageManager` field, which this one does not — but pin it off
+          # so adding that field later cannot silently break the build.
+          package-manager-cache: false
 
       # No install step for the same reason. `npm ci` would fail outright
       # without a lockfile. The suite is `node --test` over the repo as-is.