From f03d7e7216223bcaa7dcf486ae13bc52828ba558 Mon Sep 17 00:00:00 2001 From: Jonathan Roemer Date: Mon, 19 Oct 2026 09:56:00 -0500 Subject: [PATCH 1/2] factory: run CI on Node 24 (Active LTS) Co-Authored-By: Claude Opus 5.5 --- .github/workflows/conformance.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/conformance.yml b/.github/workflows/conformance.yml index 9328007..c8638e5 100644 --- a/.github/workflows/conformance.yml +++ b/.github/workflows/conformance.yml @@ -24,7 +24,7 @@ jobs: - uses: actions/setup-node@v4 with: - node-version: 22 + node-version: 24 # koreader/test-data holds leaves.epub and tall.pdf, whose partial-MD5 # digests are pinned in KOReader's own spec/unit/util_spec.lua. Checking @@ -55,7 +55,7 @@ jobs: - uses: actions/setup-node@v4 with: - node-version: 22 + node-version: 24 - name: Wait for the reference server run: | @@ -133,7 +133,7 @@ jobs: - uses: actions/checkout@v4 - uses: actions/setup-node@v4 with: - node-version: 22 + node-version: 24 - run: node --check verify.mjs - run: node --check vectors/check.mjs - run: node --check coverage.mjs From bb4adbe0e233bb6bc23872bd8c3b012847766a91 Mon Sep 17 00:00:00 2001 From: Jonathan Roemer Date: Mon, 19 Oct 2026 09:56:07 -0500 Subject: [PATCH 2/2] factory: pin GitHub Actions and Semgrep image by SHA at latest releases actions/checkout v4/v6 -> v7.0.1, actions/setup-node v4 -> v7.1.0, actions/upload-artifact v4 -> v7.0.2, semgrep/semgrep -> 1.181.0 by digest. Fixes Semgrep github-actions-mutable-action-tag. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/conformance.yml | 14 +++++++------- .github/workflows/semgrep.yml | 4 ++-- 2 files changed, 9 insertions(+), 9 deletions(-) diff --git a/.github/workflows/conformance.yml b/.github/workflows/conformance.yml index c8638e5..d5fc121 100644 --- a/.github/workflows/conformance.yml +++ b/.github/workflows/conformance.yml @@ -20,9 +20,9 @@ jobs: name: document-hash vectors runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: actions/setup-node@v4 + - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: 24 @@ -51,9 +51,9 @@ jobs: # self-signed certificate that Node's fetch rejects. - 8080:17200 steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: actions/setup-node@v4 + - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: 24 @@ -120,7 +120,7 @@ jobs: ' >> "$GITHUB_STEP_SUMMARY" fi - - uses: actions/upload-artifact@v4 + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 if: always() with: name: reference-report @@ -130,8 +130,8 @@ jobs: name: verifier loads runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 - - uses: actions/setup-node@v4 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: 24 - run: node --check verify.mjs diff --git a/.github/workflows/semgrep.yml b/.github/workflows/semgrep.yml index 76cad91..e7f15c8 100644 --- a/.github/workflows/semgrep.yml +++ b/.github/workflows/semgrep.yml @@ -20,7 +20,7 @@ jobs: env: SEMGREP_APP_TOKEN: ${{ secrets.SEMGREP_APP_TOKEN }} container: - image: semgrep/semgrep + image: semgrep/semgrep:1.181.0@sha256:81474464c1f07483ba0682a44787fd93c91397419762a04abe2bafaae396304b steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - run: semgrep ci