From f9c8778cd3718307c916669c308636074f88be57 Mon Sep 17 00:00:00 2001 From: Robin Bolscher Date: Fri, 23 Oct 2026 09:30:38 +0200 Subject: [PATCH 1/4] ci: Pin development and CI to Node 22 The repository supports Node 22 and up, but every workflow ran Node 24 through .nvmrc, so the supported floor was never the version anything was actually checked against. Verified on Node 22.23.4, the current 22.x, at the tip of the open stack: npm ci, 114 tests pass, lint, format:check, the docs build, generate-types with an unchanged index.d.ts, and tsc all succeed. That includes the native type stripping #243 relies on, which needs Node 22.18 or newer; `22` in .nvmrc resolves to the latest 22.x. engines.node stays ">=22": consumers are not restricted to 22, this only fixes what the project itself develops and tests against. --- .nvmrc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.nvmrc b/.nvmrc index a45fd52c..2bd5a0a9 100644 --- a/.nvmrc +++ b/.nvmrc @@ -1 +1 @@ -24 +22 From 187ec5e4eb611cd1a06d4535f2e336be2755f41f Mon Sep 17 00:00:00 2001 From: Robin Bolscher Date: Fri, 23 Oct 2026 09:30:38 +0200 Subject: [PATCH 2/4] ci: Gate the testing branch, cache npm, update the actions Four unrelated bits of workflow upkeep. Pushes to `testing` ran neither Lint nor Test, while deploy.yml publishes a beta from that same branch. Both workflows now trigger on it. setup-node gets `cache: 'npm'` in the four workflows that lacked it; generate-types.yml already had it. They each re-resolved the whole tree on every run. actions/checkout and actions/setup-node go from v4 to v7, and peaceiris/actions-gh-pages from v3.8.0 to v4. The deploy.yml header still described a Node 12 environment; it has read the version from .nvmrc for a long time. --- .github/workflows/deploy.yml | 7 ++++--- .github/workflows/docs.yml | 7 ++++--- .github/workflows/generate-types.yml | 4 ++-- .github/workflows/lint.yml | 6 ++++-- .github/workflows/test.yml | 6 ++++-- 5 files changed, 18 insertions(+), 12 deletions(-) diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml index 0a5e925c..a45dd633 100644 --- a/.github/workflows/deploy.yml +++ b/.github/workflows/deploy.yml @@ -2,7 +2,7 @@ name: Deploy # About this workflow: # It is triggered on push events to branches production and testing. Then it performs a checkout of the current repo -# and sets up a node environment (v12). Following, it will run `npm ci` to build the package. Next, it will look at your +# and sets up a node environment (see .nvmrc). Following, it will run `npm ci` to build the package. Next, it will look at your # commit message, if it includes '#patch', '#minor', or '#major' it will bump the package version accordingly. # Finally, the `npm publish` command will be run, when on branch testing it will run `npm publish --tag beta` to publish # it under the beta flag on npm. Note: if no '#patch', '#minor', or '#major' flag is present in the latest commit @@ -49,7 +49,7 @@ jobs: steps: # Checks out the current repository. - name: Checkout git repository - uses: actions/checkout@v4 + uses: actions/checkout@v7 with: # The token below is only necessary if you want to push the version bump to a protected branch token: ${{ secrets.HOMEY_GITHUB_ACTIONS_BOT_PERSONAL_ACCESS_TOKEN }} @@ -63,9 +63,10 @@ jobs: # Configures a Node.js environment pointed at the public npm registry so # `npm publish` uses OIDC against npmjs.org. - name: Set up Node.js - uses: actions/setup-node@v4 + uses: actions/setup-node@v7 with: node-version-file: .nvmrc + cache: 'npm' registry-url: https://registry.npmjs.org # Run `npm ci && npm run build` to re-create your local environment (make sure to commit your - package-lock.json!). diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml index ecf72bdd..1fe6073e 100644 --- a/.github/workflows/docs.yml +++ b/.github/workflows/docs.yml @@ -27,12 +27,13 @@ jobs: name: Build & Deploy to GitHub Pages runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - name: Setup Node.js - uses: actions/setup-node@v4 + uses: actions/setup-node@v7 with: node-version-file: .nvmrc + cache: 'npm' # Build - name: Build @@ -42,7 +43,7 @@ jobs: # Deploy - name: Deploy To GitHub Pages - uses: peaceiris/actions-gh-pages@v3.8.0 + uses: peaceiris/actions-gh-pages@v4 with: personal_token: ${{ secrets.HOMEY_GITHUB_ACTIONS_BOT_PERSONAL_ACCESS_TOKEN }} publish_dir: ./build diff --git a/.github/workflows/generate-types.yml b/.github/workflows/generate-types.yml index 7b6149fc..3dc47911 100644 --- a/.github/workflows/generate-types.yml +++ b/.github/workflows/generate-types.yml @@ -23,13 +23,13 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@v7 with: ref: ${{ github.ref_name }} token: ${{ secrets.HOMEY_GITHUB_ACTIONS_BOT_PERSONAL_ACCESS_TOKEN }} - name: Setup Node.js - uses: actions/setup-node@v4 + uses: actions/setup-node@v7 with: node-version-file: .nvmrc cache: 'npm' diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml index d94386dd..39e9edde 100644 --- a/.github/workflows/lint.yml +++ b/.github/workflows/lint.yml @@ -13,6 +13,7 @@ on: branches: - master - production + - testing pull_request: jobs: @@ -21,12 +22,13 @@ jobs: runs-on: ubuntu-latest steps: # Checks out the current repository. - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 # Configures a Node.js environment. - - uses: actions/setup-node@v4 + - uses: actions/setup-node@v7 with: node-version-file: .nvmrc + cache: 'npm' # Run `npm ci` to re-create your local environment (make sure to commit your package-lock.json!). # Finally run `npm run lint` (make sure you have defined a lint command in package.json e.g. "lint": "eslint ."). diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 0c345f63..540f04dc 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -13,6 +13,7 @@ on: branches: - master - production + - testing pull_request: jobs: @@ -22,12 +23,13 @@ jobs: steps: # Checks out the current repository. - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 # Configures a Node.js environment. - - uses: actions/setup-node@v4 + - uses: actions/setup-node@v7 with: node-version-file: .nvmrc + cache: 'npm' # Run `npm ci` to re-create your local environment (make sure to commit your package-lock.json!). # Finally run `npm test` (make sure you have defined a proper test command in package.json). From a88b95ebf02e9428c2ce53dab0aff414ed030483 Mon Sep 17 00:00:00 2001 From: Robin Bolscher Date: Fri, 23 Oct 2026 09:30:38 +0200 Subject: [PATCH 3/4] ci: Keep publishing working on Node 22 and gate it on the checks Two problems the Node 22 pin exposed in deploy.yml. Publishing uses OIDC trusted publishing with --provenance and carries no NPM_AUTH_TOKEN, and that needs npm 11.5.1 or newer. Node 22 bundles npm 10.9.9, and setup-node installs whatever npm ships with the Node version it selects, so both the production and the beta publish would have failed authentication, after the version bump and tags had already been pushed. npm is now upgraded explicitly. npm 11 needs Node >=22.9.0 and `22` in .nvmrc resolves well past that. Adding `testing` to the Lint and Test workflows made the checks run on that branch but did not hold anything back: deploy.yml starts on the same push and neither waits for them nor repeats them, so a `#patch` push could still publish a beta before they finished. The deploy job now runs lint, format:check and the tests itself, before the version bump, so a failure stops the publish instead of racing it. --- .github/workflows/deploy.yml | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml index a45dd633..d5e63601 100644 --- a/.github/workflows/deploy.yml +++ b/.github/workflows/deploy.yml @@ -69,12 +69,25 @@ jobs: cache: 'npm' registry-url: https://registry.npmjs.org + # OIDC trusted publishing needs npm 11.5.1 or newer. Node 22 bundles npm 10, + # and setup-node installs whatever npm ships with the Node version. + - name: Upgrade npm for trusted publishing + run: npm install -g npm@^11.5.1 + # Run `npm ci && npm run build` to re-create your local environment (make sure to commit your - package-lock.json!). - name: Build run: | npm ci npm run build + # Nothing below this point runs if the package does not lint, format or test + # cleanly, so a push to testing cannot publish a beta that was never checked. + - name: Validate + run: | + npm run lint + npm run format:check + npm test + - name: Version bump patch if: github.event.inputs.versionBumpType == 'patch' || contains(github.event.head_commit.message, '#patch') && !contains(github.event.head_commit.message, '#minor') && !contains(github.event.head_commit.message, '#major') run: | From ae2a43df71949ec5b86c4423c4575ef5535b4b58 Mon Sep 17 00:00:00 2001 From: Robin Bolscher Date: Fri, 23 Oct 2026 09:30:38 +0200 Subject: [PATCH 4/4] ci: Validate before building the docs in the deploy job The docs build is the slowest step in the job and nothing about publishing depends on it, so running lint, format:check and the tests first means a failing check stops the job before that minute is spent. Build and the publish steps that follow are unchanged. --- .github/workflows/deploy.yml | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml index d5e63601..805d7bfe 100644 --- a/.github/workflows/deploy.yml +++ b/.github/workflows/deploy.yml @@ -74,20 +74,22 @@ jobs: - name: Upgrade npm for trusted publishing run: npm install -g npm@^11.5.1 - # Run `npm ci && npm run build` to re-create your local environment (make sure to commit your - package-lock.json!). - - name: Build - run: | - npm ci - npm run build + # Run `npm ci` to re-create your local environment (make sure to commit your - package-lock.json!). + - name: Install + run: npm ci # Nothing below this point runs if the package does not lint, format or test # cleanly, so a push to testing cannot publish a beta that was never checked. + # Ahead of the docs build, which is the slowest step here. - name: Validate run: | npm run lint npm run format:check npm test + - name: Build + run: npm run build + - name: Version bump patch if: github.event.inputs.versionBumpType == 'patch' || contains(github.event.head_commit.message, '#patch') && !contains(github.event.head_commit.message, '#minor') && !contains(github.event.head_commit.message, '#major') run: |