mirror of
https://github.com/stablyai/orca.git
synced 2026-10-31 00:57:45 +00:00
fix(security): update Node runtimes for October security releases (#31687)
* fix(security): update Node runtimes for October security releases * fix(ci): compare normalized web file inventory without ordering artifacts
This commit is contained in:
Neil
@@ -175,6 +175,7 @@ jobs:
|
||||
uses: actions/setup-node@v6
|
||||
with:
|
||||
node-version-file: package.json
|
||||
check-latest: true
|
||||
package-manager-cache: false
|
||||
|
||||
- name: Compute adhoc version
|
||||
@@ -415,6 +416,7 @@ jobs:
|
||||
uses: actions/setup-node@v6
|
||||
with:
|
||||
node-version-file: package.json
|
||||
check-latest: true
|
||||
cache: pnpm
|
||||
cache-dependency-path: |
|
||||
pnpm-lock.yaml
|
||||
|
||||
@@ -32,6 +32,7 @@ jobs:
|
||||
- uses: actions/setup-node@v6
|
||||
with:
|
||||
node-version-file: package.json
|
||||
check-latest: true
|
||||
package-manager-cache: false
|
||||
- uses: ./.github/actions/prepare-xterm-dependencies
|
||||
id: cache
|
||||
|
||||
@@ -66,6 +66,7 @@ jobs:
|
||||
- uses: actions/setup-node@v4
|
||||
with:
|
||||
node-version: 24
|
||||
check-latest: true
|
||||
|
||||
- name: Require explicit bootstrap confirmation
|
||||
env:
|
||||
|
||||
@@ -168,6 +168,7 @@ jobs:
|
||||
- uses: actions/setup-node@v4
|
||||
with:
|
||||
node-version: 24
|
||||
check-latest: true
|
||||
|
||||
- run: pnpm install --frozen-lockfile
|
||||
|
||||
|
||||
@@ -137,6 +137,7 @@ jobs:
|
||||
- uses: actions/setup-node@v4
|
||||
with:
|
||||
node-version: 24
|
||||
check-latest: true
|
||||
|
||||
- run: pnpm install --frozen-lockfile
|
||||
|
||||
|
||||
@@ -122,6 +122,7 @@ jobs:
|
||||
- uses: actions/setup-node@v4
|
||||
with:
|
||||
node-version: 24
|
||||
check-latest: true
|
||||
|
||||
- name: Resolve immutable production image
|
||||
shell: bash
|
||||
|
||||
@@ -194,6 +194,7 @@ jobs:
|
||||
- uses: actions/setup-node@v4
|
||||
with:
|
||||
node-version: 24
|
||||
check-latest: true
|
||||
|
||||
- run: pnpm install --frozen-lockfile
|
||||
|
||||
|
||||
@@ -97,6 +97,7 @@ jobs:
|
||||
- uses: actions/setup-node@v4
|
||||
with:
|
||||
node-version: 24
|
||||
check-latest: true
|
||||
|
||||
- run: pnpm install --frozen-lockfile
|
||||
|
||||
|
||||
@@ -99,7 +99,7 @@ jobs:
|
||||
fetch-depth: 0
|
||||
|
||||
- uses: actions/setup-node@v4
|
||||
with: { node-version: 24 }
|
||||
with: { node-version: 24, check-latest: true }
|
||||
|
||||
- id: wave
|
||||
env:
|
||||
@@ -361,7 +361,7 @@ jobs:
|
||||
- uses: actions/checkout@v4
|
||||
|
||||
- uses: actions/setup-node@v4
|
||||
with: { node-version: 24 }
|
||||
with: { node-version: 24, check-latest: true }
|
||||
|
||||
# Its pace checks are what let a batch drain faster than the default; a missing artifact
|
||||
# seals UNVERIFIED, which only the default accepts. Named from the gate's normalized cell,
|
||||
|
||||
@@ -91,6 +91,7 @@ jobs:
|
||||
- uses: actions/setup-node@v4
|
||||
with:
|
||||
node-version: 24
|
||||
check-latest: true
|
||||
|
||||
- run: pnpm install --frozen-lockfile
|
||||
|
||||
|
||||
@@ -77,6 +77,7 @@ jobs:
|
||||
- uses: actions/setup-node@v4
|
||||
with:
|
||||
node-version: 24
|
||||
check-latest: true
|
||||
|
||||
- name: Require explicit mutation confirmation
|
||||
if: ${{ inputs.mode != 'preflight' }}
|
||||
|
||||
@@ -167,6 +167,7 @@ jobs:
|
||||
- uses: actions/setup-node@v4
|
||||
with:
|
||||
node-version: 24
|
||||
check-latest: true
|
||||
|
||||
- name: Require the mirrored immutable image
|
||||
run: |
|
||||
|
||||
@@ -65,6 +65,7 @@ jobs:
|
||||
- uses: actions/setup-node@v4
|
||||
with:
|
||||
node-version: 24
|
||||
check-latest: true
|
||||
|
||||
- run: pnpm install --frozen-lockfile
|
||||
|
||||
|
||||
@@ -193,6 +193,7 @@ jobs:
|
||||
- uses: actions/setup-node@v4
|
||||
with:
|
||||
node-version: 24
|
||||
check-latest: true
|
||||
|
||||
- uses: pnpm/setup@v2
|
||||
with:
|
||||
|
||||
@@ -82,6 +82,7 @@ jobs:
|
||||
- uses: actions/setup-node@v4
|
||||
with:
|
||||
node-version: 24
|
||||
check-latest: true
|
||||
|
||||
- id: google-auth
|
||||
uses: google-github-actions/auth@v2
|
||||
|
||||
@@ -106,6 +106,7 @@ jobs:
|
||||
- uses: actions/setup-node@v4
|
||||
with:
|
||||
node-version: 24
|
||||
check-latest: true
|
||||
|
||||
- id: google-auth
|
||||
uses: google-github-actions/auth@v2
|
||||
|
||||
@@ -114,6 +114,7 @@ jobs:
|
||||
- uses: actions/setup-node@v4
|
||||
with:
|
||||
node-version: 24
|
||||
check-latest: true
|
||||
|
||||
- id: google-auth-1
|
||||
uses: google-github-actions/auth@v2
|
||||
@@ -276,6 +277,7 @@ jobs:
|
||||
if: ${{ always() }}
|
||||
with:
|
||||
node-version: 24
|
||||
check-latest: true
|
||||
|
||||
- id: google-auth
|
||||
if: ${{ always() }}
|
||||
|
||||
@@ -84,6 +84,7 @@ jobs:
|
||||
- uses: actions/setup-node@v4
|
||||
with:
|
||||
node-version: 24
|
||||
check-latest: true
|
||||
|
||||
- id: google-auth
|
||||
uses: google-github-actions/auth@v2
|
||||
|
||||
@@ -76,6 +76,7 @@ jobs:
|
||||
- uses: actions/setup-node@v4
|
||||
with:
|
||||
node-version: 24
|
||||
check-latest: true
|
||||
|
||||
- name: Require explicit manual mutation confirmation
|
||||
if: ${{ github.event_name == 'workflow_dispatch' && inputs.mode != 'status' }}
|
||||
|
||||
@@ -123,6 +123,7 @@ jobs:
|
||||
- uses: actions/setup-node@v4
|
||||
with:
|
||||
node-version: 24
|
||||
check-latest: true
|
||||
|
||||
- uses: pnpm/setup@v2
|
||||
with:
|
||||
@@ -346,6 +347,7 @@ jobs:
|
||||
- uses: actions/setup-node@v4
|
||||
with:
|
||||
node-version: 24
|
||||
check-latest: true
|
||||
|
||||
- name: Recover staging C4 with a fresh identity
|
||||
env:
|
||||
@@ -433,6 +435,7 @@ jobs:
|
||||
- uses: actions/setup-node@v4
|
||||
with:
|
||||
node-version: 24
|
||||
check-latest: true
|
||||
|
||||
- uses: pnpm/setup@v2
|
||||
with:
|
||||
|
||||
@@ -107,6 +107,7 @@ jobs:
|
||||
- uses: actions/setup-node@v4
|
||||
with:
|
||||
node-version: 24
|
||||
check-latest: true
|
||||
|
||||
- name: Initialize the exact staging backend
|
||||
if: ${{ inputs.mode != 'restore-admission' }}
|
||||
@@ -655,6 +656,7 @@ jobs:
|
||||
- uses: actions/setup-node@v4
|
||||
with:
|
||||
node-version: 24
|
||||
check-latest: true
|
||||
|
||||
- name: Initialize the exact staging backend
|
||||
run: node dev/scripts/infra.mjs init --env staging
|
||||
|
||||
@@ -102,6 +102,7 @@ jobs:
|
||||
- uses: actions/setup-node@v4
|
||||
with:
|
||||
node-version: 24
|
||||
check-latest: true
|
||||
|
||||
- name: Initialize the exact staging backend
|
||||
run: node dev/scripts/infra.mjs init --env staging
|
||||
|
||||
@@ -94,6 +94,7 @@ jobs:
|
||||
- uses: actions/setup-node@v4
|
||||
with:
|
||||
node-version: 24
|
||||
check-latest: true
|
||||
|
||||
- run: pnpm install --frozen-lockfile
|
||||
- run: pnpm build
|
||||
@@ -134,6 +135,7 @@ jobs:
|
||||
- uses: actions/setup-node@v4
|
||||
with:
|
||||
node-version: 24
|
||||
check-latest: true
|
||||
|
||||
- run: pnpm install --frozen-lockfile
|
||||
- run: pnpm test
|
||||
|
||||
@@ -41,6 +41,7 @@ jobs:
|
||||
uses: actions/setup-node@v6
|
||||
with:
|
||||
node-version-file: package.json
|
||||
check-latest: true
|
||||
|
||||
- name: Setup pnpm
|
||||
uses: pnpm/setup@v2
|
||||
|
||||
@@ -188,6 +188,7 @@ jobs:
|
||||
uses: actions/setup-node@v6
|
||||
with:
|
||||
node-version-file: package.json
|
||||
check-latest: true
|
||||
cache: pnpm
|
||||
cache-dependency-path: |
|
||||
pnpm-lock.yaml
|
||||
|
||||
@@ -236,6 +236,7 @@ jobs:
|
||||
uses: actions/setup-node@v6
|
||||
with:
|
||||
node-version-file: package.json
|
||||
check-latest: true
|
||||
cache: pnpm
|
||||
cache-dependency-path: |
|
||||
pnpm-lock.yaml
|
||||
|
||||
@@ -56,6 +56,7 @@ jobs:
|
||||
uses: actions/setup-node@v6
|
||||
with:
|
||||
node-version-file: docs/site/package.json
|
||||
check-latest: true
|
||||
# setup-node probes the store from the repository root, not this app.
|
||||
package-manager-cache: false
|
||||
|
||||
@@ -228,6 +229,7 @@ jobs:
|
||||
uses: actions/setup-node@v6
|
||||
with:
|
||||
node-version-file: docs/site/package.json
|
||||
check-latest: true
|
||||
package-manager-cache: false
|
||||
|
||||
- name: Install site dependencies
|
||||
|
||||
@@ -41,6 +41,7 @@ jobs:
|
||||
uses: actions/setup-node@v6
|
||||
with:
|
||||
node-version-file: package.json
|
||||
check-latest: true
|
||||
|
||||
- name: Setup pnpm
|
||||
uses: pnpm/setup@v2
|
||||
|
||||
@@ -177,6 +177,7 @@ jobs:
|
||||
uses: actions/setup-node@v6
|
||||
with:
|
||||
node-version-file: package.json
|
||||
check-latest: true
|
||||
cache: pnpm
|
||||
cache-dependency-path: |
|
||||
pnpm-lock.yaml
|
||||
|
||||
@@ -22,6 +22,7 @@ jobs:
|
||||
uses: actions/setup-node@v6
|
||||
with:
|
||||
node-version-file: package.json
|
||||
check-latest: true
|
||||
|
||||
- name: Setup pnpm
|
||||
uses: pnpm/setup@v2
|
||||
|
||||
@@ -46,6 +46,7 @@ jobs:
|
||||
uses: actions/setup-node@v6
|
||||
with:
|
||||
node-version: 24
|
||||
check-latest: true
|
||||
|
||||
- name: Setup pnpm
|
||||
uses: pnpm/setup@v2
|
||||
|
||||
@@ -62,6 +62,7 @@ jobs:
|
||||
uses: actions/setup-node@v6
|
||||
with:
|
||||
node-version: 24
|
||||
check-latest: true
|
||||
|
||||
- name: Setup pnpm
|
||||
uses: pnpm/setup@v2
|
||||
|
||||
@@ -78,6 +78,7 @@ jobs:
|
||||
- uses: actions/setup-node@v6
|
||||
with:
|
||||
node-version-file: package.json
|
||||
check-latest: true
|
||||
package-manager-cache: false
|
||||
- name: Detect headless-server build and test inputs
|
||||
id: scope
|
||||
@@ -526,7 +527,7 @@ jobs:
|
||||
-e ORCA_BACKGROUND_LAUNCH=1 \
|
||||
-v "$VERIFICATION_CACHE_PATH:/root/.cache/pnpm/lockfile-verified.jsonl" \
|
||||
-v "$GITHUB_WORKSPACE:/work" -w /work \
|
||||
node:24.21.0-alpine@sha256:ebfe2f90462722a7a4de65e91990e97fe0d401c70e0e762c5b53302f905ec1c1 sleep infinity
|
||||
node:24.22.1-alpine@sha256:6a1c190e17215d844926b0677f4bf87273ff7d5e54db06d3b5b5863ab0b09a3d sleep infinity
|
||||
docker exec -i orcad-alpine sh -s <<'NODE_SERVER_PREPARATION'
|
||||
set -eu
|
||||
apk add --no-cache bash git libstdc++ python3 make g++
|
||||
|
||||
@@ -755,6 +755,7 @@ jobs:
|
||||
- uses: actions/setup-node@v6
|
||||
with:
|
||||
node-version-file: package.json
|
||||
check-latest: true
|
||||
package-manager-cache: false
|
||||
|
||||
# Rebuild both pristine and patched bundles; reuse only the pinned toolchain.
|
||||
@@ -1529,6 +1530,7 @@ jobs:
|
||||
- uses: actions/setup-node@v6
|
||||
with:
|
||||
node-version-file: package.json
|
||||
check-latest: true
|
||||
package-manager-cache: false
|
||||
|
||||
- name: Setup pnpm
|
||||
|
||||
@@ -32,6 +32,7 @@ jobs:
|
||||
- uses: actions/setup-node@v6
|
||||
with:
|
||||
node-version-file: package.json
|
||||
check-latest: true
|
||||
package-manager-cache: false
|
||||
- name: Checkout the workflow policy
|
||||
uses: actions/checkout@v6
|
||||
|
||||
@@ -128,6 +128,7 @@ jobs:
|
||||
uses: actions/setup-node@v6
|
||||
with:
|
||||
node-version-file: package.json
|
||||
check-latest: true
|
||||
|
||||
- name: Configure git author
|
||||
run: |
|
||||
@@ -902,6 +903,7 @@ jobs:
|
||||
uses: actions/setup-node@v6
|
||||
with:
|
||||
node-version-file: package.json
|
||||
check-latest: true
|
||||
cache: pnpm
|
||||
|
||||
# Why: Linux terminal golden E2E uses the same native install path as
|
||||
@@ -1128,6 +1130,7 @@ jobs:
|
||||
uses: actions/setup-node@v6
|
||||
with:
|
||||
node-version-file: package.json
|
||||
check-latest: true
|
||||
cache: pnpm
|
||||
|
||||
# Why: keep the non-blocking evidence lane on the same Linux native
|
||||
@@ -1351,6 +1354,7 @@ jobs:
|
||||
uses: actions/setup-node@v6
|
||||
with:
|
||||
node-version-file: package.json
|
||||
check-latest: true
|
||||
cache: pnpm
|
||||
cache-dependency-path: |
|
||||
pnpm-lock.yaml
|
||||
@@ -2377,6 +2381,7 @@ jobs:
|
||||
uses: actions/setup-node@v6
|
||||
with:
|
||||
node-version-file: package.json
|
||||
check-latest: true
|
||||
|
||||
- name: Run isolated macOS release build
|
||||
id: dispatch
|
||||
@@ -2413,6 +2418,7 @@ jobs:
|
||||
uses: actions/setup-node@v6
|
||||
with:
|
||||
node-version-file: package.json
|
||||
check-latest: true
|
||||
|
||||
- name: Require the exact isolated macOS release build to succeed
|
||||
run: node config/scripts/run-release-mac-build-workflow.mjs wait
|
||||
@@ -2457,6 +2463,7 @@ jobs:
|
||||
uses: actions/setup-node@v6
|
||||
with:
|
||||
node-version-file: package.json
|
||||
check-latest: true
|
||||
|
||||
- name: Verify release is still draft
|
||||
env:
|
||||
|
||||
@@ -102,6 +102,7 @@ jobs:
|
||||
- uses: actions/setup-node@v6
|
||||
with:
|
||||
node-version-file: package.json
|
||||
check-latest: true
|
||||
- uses: ./.github/actions/install-node-dependencies
|
||||
- uses: actions/download-artifact@v8
|
||||
with:
|
||||
|
||||
@@ -91,6 +91,7 @@ jobs:
|
||||
uses: actions/setup-node@v6
|
||||
with:
|
||||
node-version-file: package.json
|
||||
check-latest: true
|
||||
cache: pnpm
|
||||
cache-dependency-path: |
|
||||
pnpm-lock.yaml
|
||||
|
||||
@@ -50,6 +50,7 @@ jobs:
|
||||
id: node
|
||||
with:
|
||||
node-version-file: package.json
|
||||
check-latest: true
|
||||
- name: Verify pinned symlink placement with autocrlf false
|
||||
if: ${{ !cancelled() && matrix.skills-cli == 'pinned' && steps.checkout.outcome == 'success' && steps.node.outcome == 'success' }}
|
||||
env:
|
||||
|
||||
@@ -116,7 +116,7 @@ jobs:
|
||||
-e ORCA_BACKGROUND_LAUNCH=1 \
|
||||
-v "$VERIFICATION_CACHE_PATH:/root/.cache/pnpm/lockfile-verified.jsonl" \
|
||||
-v "$GITHUB_WORKSPACE:/work" -w /work \
|
||||
node:24.21.0-alpine@sha256:ebfe2f90462722a7a4de65e91990e97fe0d401c70e0e762c5b53302f905ec1c1 sh -s <<'MUSL_SLOT'
|
||||
node:24.22.1-alpine@sha256:6a1c190e17215d844926b0677f4bf87273ff7d5e54db06d3b5b5863ab0b09a3d sh -s <<'MUSL_SLOT'
|
||||
set -eu
|
||||
apk add --no-cache bash git libstdc++ python3 make g++
|
||||
git config --global --add safe.directory /work
|
||||
|
||||
@@ -115,6 +115,7 @@ jobs:
|
||||
uses: actions/setup-node@v6
|
||||
with:
|
||||
node-version-file: package.json
|
||||
check-latest: true
|
||||
cache: pnpm
|
||||
|
||||
# Historical refs can lack the shared action; retain their original install path.
|
||||
|
||||
@@ -14,7 +14,7 @@ jobs:
|
||||
baseline:
|
||||
uses: ./.github/workflows/unit-tests.yml
|
||||
with:
|
||||
node_versions: '["24.21.0"]'
|
||||
node_versions: '["24.22.1"]'
|
||||
runner: ubuntu-24.04-arm
|
||||
shards: '[{"index":1,"count":5},{"index":2,"count":5},{"index":3,"count":5},{"index":4,"count":5},{"index":5,"count":5}]'
|
||||
artifact_prefix: baseline-unit
|
||||
@@ -25,7 +25,7 @@ jobs:
|
||||
needs: baseline
|
||||
uses: ./.github/workflows/unit-tests.yml
|
||||
with:
|
||||
node_versions: '["24.21.0"]'
|
||||
node_versions: '["24.22.1"]'
|
||||
runner: ubuntu-24.04-arm
|
||||
shards: '[{"index":1,"count":5},{"index":2,"count":5},{"index":3,"count":5},{"index":4,"count":5},{"index":5,"count":5}]'
|
||||
artifact_prefix: producer-unit
|
||||
@@ -39,7 +39,7 @@ jobs:
|
||||
needs: producer
|
||||
uses: ./.github/workflows/unit-tests.yml
|
||||
with:
|
||||
node_versions: '["24.21.0"]'
|
||||
node_versions: '["24.22.1"]'
|
||||
runner: ubuntu-24.04-arm
|
||||
shards: '[{"index":1,"count":5},{"index":2,"count":5},{"index":3,"count":5},{"index":4,"count":5},{"index":5,"count":5}]'
|
||||
artifact_prefix: warm-unit
|
||||
|
||||
@@ -55,6 +55,7 @@ jobs:
|
||||
uses: actions/setup-node@v6
|
||||
with:
|
||||
node-version-file: package.json
|
||||
check-latest: true
|
||||
cache: pnpm
|
||||
cache-dependency-path: |
|
||||
pnpm-lock.yaml
|
||||
|
||||
@@ -83,6 +83,7 @@ jobs:
|
||||
uses: actions/setup-node@v6
|
||||
with:
|
||||
node-version-file: package.json
|
||||
check-latest: true
|
||||
|
||||
- name: Setup pnpm
|
||||
uses: pnpm/setup@v2
|
||||
|
||||
@@ -71,6 +71,7 @@ jobs:
|
||||
uses: actions/setup-node@v6
|
||||
with:
|
||||
node-version-file: package.json
|
||||
check-latest: true
|
||||
|
||||
- name: Setup pnpm
|
||||
uses: pnpm/setup@v2
|
||||
|
||||
@@ -49,7 +49,7 @@ jobs:
|
||||
node -e 'require("node:fs").writeFileSync(".build/windows-native-benchmark/job-start.json", JSON.stringify({startedAt:new Date().toISOString()}))'
|
||||
- uses: ./.github/actions/install-node-dependencies
|
||||
with:
|
||||
node-version: '24.21.0'
|
||||
node-version: '24.22.1'
|
||||
native-runtime: none
|
||||
cache-pnpm-store: 'false'
|
||||
cache-pnpm-verification: 'false'
|
||||
|
||||
@@ -56,6 +56,7 @@ jobs:
|
||||
uses: actions/setup-node@v6
|
||||
with:
|
||||
node-version-file: package.json
|
||||
check-latest: true
|
||||
cache: pnpm
|
||||
cache-dependency-path: |
|
||||
pnpm-lock.yaml
|
||||
|
||||
@@ -41,6 +41,7 @@ jobs:
|
||||
uses: actions/setup-node@v6
|
||||
with:
|
||||
node-version-file: package.json
|
||||
check-latest: true
|
||||
cache: pnpm
|
||||
|
||||
- name: Install dependencies
|
||||
|
||||
Reference in New Issue
Block a user