chore(ci-governance): synchronize Node profile

Governance-Provenance: hmac-sha256:5c754083c5edd82d09fbc963e4382cc72582a4470994705efcd9a9588df659b7

Author: inditextechci-sync[bot]

.github/inditextech-ci-sync-manifest.json

@@ -13,7 +13,7 @@
   "creation_year": 2026,
   "integrity": {
     "algorithm": "hmac-sha256",
-    "signature": "6cbdc2ef01327a5d5d9bc3da231434bb01b83dc5878f319398798c12c3904c5e"
+    "signature": "3633e607144a5e6a891f585605a8730dc743cbdf59c2c5f67164d11e77232b10"
   },
   "managed_by": "InditexTech CI governance",
   "managed_paths": {
@@ -29,10 +29,10 @@
     ".github/workflows/code-npm_node-sonarcloud-analysis.yml": "70c1c21825cde574d4744b308e198d030dbabddaa0f8ba07980be253ea6d7afa",
     ".github/workflows/code-release_preview.yml": "4e2e95d60a498eb12d97ba5c8330b1173f04b02c807140beddad06a6e225b166",
     ".github/workflows/codeql.yml": "633c0f288566fd1408e7ad545c7631e05f861ebf4ebdce3fe9586672ef065d97",
-    ".github/workflows/pr-verify.yml": "f52295fbfe81578c0a6459d8b384be569933ac78d32fff370932a8dec6943e46",
-    ".github/workflows/push-verify.yml": "fd700ba0ee23fdee9cd7ecf23ad386247f4b621b73cc1946f9ef0eda4ea07086",
-    ".github/workflows/scorecard-analysis.yml": "5bd6da647f708cced5d33411cc27aac7f7ee2be06ae541defea677d70fe80481",
-    ".github/workflows/sync-to-develop.yml": "5c35cf0b946a939d0324b1530a78e319e979f993bd1f0105e64fc4478395d8d7",
+    ".github/workflows/pr-verify.yml": "b39240fd362fb004c3b47cd4189cb527d9e27a7c37645bbe6324d2a757e34f7f",
+    ".github/workflows/push-verify.yml": "49e6e9c6a7015ea59a2bc831982b2fc4bfd1d5721302f6041170b4a15b7d56e1",
+    ".github/workflows/scorecard-analysis.yml": "9866047c5d638ee5d9246e646400cad473ce8ab0f66b444337405b8f9f324f6e",
+    ".github/workflows/sync-to-develop.yml": "1b2d0f33094052f771d91a7e7c29a666e8a9cee5cc5ca28e1f40168920ca2702",
     ".tool-versions": "5e7b05edf5d8df174df5dd99d012e57666ec9923ac8506df7dc7753ba41815fd",
     "CODE_OF_CONDUCT.md": "ce1e7a8f68a7917d48c03f9f7aae5529367f73af0e959276e889d33ea1e8d4ab",
     "CONTRIBUTING.md": "4e1264ca54a45df44b362c7533f0eba912bfa77b6f561121ae9e5e9d6aa00df3",
@@ -50,7 +50,7 @@
   "retained_paths": {},
   "schema_version": 2,
   "source_digests": {
-    "base": "5070fc83e3b1e67ddc4c2463e767ff3d0d364115c6433d2ae0de75afef2e0e63",
+    "base": "84ae844059a60d9ea8bc96910d88c912b9875aa90e48411b243f119f584fd571",
     "node": "d2f8082132a512a1770518d0995acf54caa0690a8e0fea20b5691805c6a5473c"
   }
 }

.github/workflows/pr-verify.yml

@@ -19,7 +19,6 @@ jobs:
     timeout-minutes: 10
     permissions:
       contents: read
-      checks: write # Lets reviewdog publish actionlint check results.
     steps:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -31,7 +30,7 @@ jobs:
       - name: Lint GitHub Actions workflows
         uses: reviewdog/action-actionlint@dbe5299849118fd6f099ba563d263d770955a64a # v1.73.2
         with:
-          reporter: github-pr-check
+          reporter: github-annotations
           fail_level: error
 
   repo-linter:

.github/workflows/push-verify.yml

@@ -22,7 +22,6 @@ jobs:
     timeout-minutes: 10
     permissions:
       contents: read
-      checks: write # Lets reviewdog publish actionlint check results.
     steps:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -32,7 +31,7 @@ jobs:
       - name: Lint GitHub Actions workflows
         uses: reviewdog/action-actionlint@dbe5299849118fd6f099ba563d263d770955a64a # v1.73.2
         with:
-          reporter: github-check
+          reporter: github-annotations
           fail_level: error
 
   repo-linter:

.github/workflows/scorecard-analysis.yml

@@ -49,8 +49,29 @@ jobs:
           path: results.sarif
           retention-days: 5
 
+      - name: Resolve code scanning availability
+        id: scanning-availability
+        env:
+          GH_TOKEN: ${{ github.token }}
+          FORCE_ENABLED: ${{ vars.CODE_SCANNING_ENABLED }}
+        run: |
+          set -euo pipefail
+          visibility="$(gh api "/repos/${GITHUB_REPOSITORY}" --jq '.visibility' 2>/dev/null || echo unknown)"
+          seat="$(gh api "/repos/${GITHUB_REPOSITORY}" --jq '.security_and_analysis.advanced_security.status // "unknown"' 2>/dev/null || echo unknown)"
+          enabled=false
+          if [ "${visibility}" = "public" ] || [ "${seat}" = "enabled" ] || [ "${FORCE_ENABLED:-}" = "true" ]; then
+            enabled=true
+          fi
+          echo "Code scanning availability: visibility=${visibility} seat=${seat} enabled=${enabled}"
+          echo "enabled=${enabled}" >> "${GITHUB_OUTPUT}"
+
       - name: Upload SARIF to Code Scanning
+        if: steps.scanning-availability.outputs.enabled == 'true'
         uses: github/codeql-action/upload-sarif@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
         with:
           sarif_file: results.sarif
           category: scorecard
+
+      - name: Report unavailable Code Scanning
+        if: steps.scanning-availability.outputs.enabled != 'true'
+        run: echo "::notice::Scorecard SARIF is retained as an artifact; Code Scanning ingestion is unavailable."

.github/workflows/sync-to-develop.yml

@@ -27,6 +27,8 @@ jobs:
     concurrency:
       group: sync-to-develop-${{ github.repository }}-${{ github.event.pull_request.base.ref }}
       cancel-in-progress: false
+    env:
+      SYNC_BASE_REF: ${{ github.event.pull_request.base.ref }}
     steps:
       # The checkout runs *before* any App credential exists. This event carries
       # the base repository's secrets, so ordering is the cheap half of the
@@ -40,7 +42,7 @@ jobs:
           # Deliberately the base branch, not the merge SHA. Central policy
           # requires this ref, and the branch is trusted here: this event only
           # fires for an already-merged pull request.
-          ref: ${{ github.event.pull_request.base.ref }}
+          ref: ${{ env.SYNC_BASE_REF }}
 
       - name: Create GitHub App token
         id: app-token