ci: pin Node to exact patched versions via central env vars#1145
Open
BYK wants to merge 2 commits into
Open
Conversation
Follow-up to d7175e2 (which pinned only the skill-eval E2E job). Every other actions/setup-node step still floated a bare major ("22"/"24") and would silently reuse the runner's pre-cached buggy patch (24.17.0 / 22.23.0). Those carry CVE-2026-48931's http.Agent fix, which added a `data` listener on idle sockets that makes keep-alive fetch reuse throw false ERR_STREAM_PREMATURE_CLOSE — fixed in 24.18.0 / 22.23.1 (nodejs/node#64004). Centralize the versions as per-workflow env vars (NODE_VERSION_22 / NODE_VERSION_24) so each file has a single source of truth, and pin the exact patched releases: - ci.yml: all 22/24 setup-node steps + the build-npm matrix (mapped from bare-major labels so the `matrix.node == '22'` artifact guard still works) - release.yml, sentry-release.yml: 22.23.1 (publish/upload over HTTPS) - docs-preview.yml: 24.18.0 Validated with actionlint (no new findings vs main).
Contributor
|
Contributor
Codecov Results 📊✅ Patch coverage is 100.00%. Project has 5115 uncovered lines. Coverage diff@@ Coverage Diff @@
## main #PR +/-##
==========================================
- Coverage 81.53% 81.52% -0.01%
==========================================
Files 397 397 —
Lines 27679 27679 —
Branches 17966 17966 —
==========================================
+ Hits 22566 22564 -2
- Misses 5113 5115 +2
- Partials 1868 1868 —Generated by Codecov Action |
The eval-skill-fork.yml `eval` job set up pnpm but never ran actions/setup-node, so pnpm install, generate:docs, and eval:skill all ran on the runner's floating Node — the exact unpinned path this PR exists to eliminate, and the one most likely to hit the false ERR_STREAM_PREMATURE_CLOSE (the skill-eval planner talks to external APIs over keep-alive fetch). Add a workflow-level NODE_VERSION_24 env var and an actions/setup-node step pinned to it, mirroring the non-fork skill-eval job in ci.yml. Validated with actionlint (no findings).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Follow-up to d7175e2, which pinned only the skill-eval E2E job to
24.18.0. Every otheractions/setup-nodestep still floated a bare major ("22"/"24") and would silently reuse the runner's pre-cached buggy patch (24.17.0 / 22.23.0).Those patches shipped CVE-2026-48931's
http.Agentfix, which added adatalistener on idle agent sockets that makes keep-alive fetch reuse throw falseERR_STREAM_PREMATURE_CLOSE("Premature close"). It's fixed in 24.18.0 and 22.23.1 (nodejs/node#64004 — http: avoid stream listeners on idle agent sockets).What changed
Centralized the Node version into per-workflow
envvars (NODE_VERSION_22/NODE_VERSION_24) as a single source of truth, and pinned the exact patched releases everywhere:ci.yml"22"/"24"setup-nodesteps (incl.build-binary,build-docs,test-e2e) +build-npmmatrixrelease.ymlsentry-release.ymldocs-preview.ymleval-skill-fork.ymlsetup-nodestepThe
build-npmmatrix keeps bare-major labels (["22", "24"]) for the job name and thematrix.node == '22'artifact guard, mapping each label to its exact env-pinned version in the step.build-binaryis included in theci.ymlrepin (itssetup-nodewent from"22"→${{ env.NODE_VERSION_22 }}). It runs the binary build viapnpm tsx script/build.ts(esbuild + fossilize — pure Node, no Bun), so the pinned Node fromsetup-nodeis what drives it. (An earlier revision of this description incorrectly saidbuild-binarywas unaffected and used Bun — that was wrong on both counts.)The fork skill-eval workflow (
eval-skill-fork.yml) had set up pnpm but never ransetup-nodeat all, sopnpm install,generate:docs, andeval:skillran on the runner's floating Node — the exact unpinned path this PR exists to close, and the one most likely to hit theERR_STREAM_PREMATURE_CLOSEregression (the skill-eval planner talks to external APIs over keep-alive fetch). Added a workflow-levelNODE_VERSION_24and a pinnedsetup-nodestep mirroring the non-fork job.Validation
actionlintpasses with zero new findings vsmain(pre-existing shellcheck style infos unchanged), including the updatedeval-skill-fork.yml.