[sadrbot]

What this PR does

CI now pins every runtime, image and cloned repo it installs, so a CI run installs the same bits each time. Node moves from the floating 24 to the exact release it resolves to today, and the reference image and the KOReader fixtures are pinned too.

Changes

• Node 24 → 24.22.1, exact pin in all three setup-node steps (.github/workflows/conformance.yml)
• koreader/kosync:latest pinned by digest to v2.1.1 (sha256:bb3f1361…), in the reference service (.github/workflows/conformance.yml) and as the default image of reference-server/run.sh
• koreader/test-data clone → fetch of commit c3b5d06 (master on 2024-12-16) instead of the branch tip, because the repo has no release tags (.github/workflows/conformance.yml)

Supply chain

• cooldown: unchanged (the repo has no package manager and no lockfile)
• pins: koreader/kosync:latest@sha256:bb3f13615365703315a43b9059f65e71e876440f867e23a42bf27f2fa18264e1 (built 2026-05-16), koreader/test-data@c3b5d06. actions/checkout v7.0.1, actions/setup-node v7.1.0, actions/upload-artifact v7.0.2 and semgrep/semgrep 1.181.0 were already the newest releases past the cooldown, pinned by SHA or digest.
• cooldown exceptions: Node 24.22.1, CVE-2026-105481, CVE-2026-105482, CVE-2026-105483, CVE-2026-106069, CVE-2026-106073, CVE-2026-106074, CVE-2026-111497, pinned at 24.22.1, expires 2026-10-28T10:38Z
• inside the cooldown (already merged): none
• waiting for cooldown: none

Security findings

• untriaged: 0 → 0 (Semgrep API and semgrep ci --dry-run)
• open: 0 → 0
• fixed: 0
• false positive: 0
• accepted risk: 0
• other: 0
• suppressions reviewed: 0

Holds

• added: cooldown exception Node 24.22.1 for CVE-2026-105481 and 6 more, pinned at 24.22.1, clears 2026-10-28T10:38Z (.github/workflows/conformance.yml)

AGENTS.md

• None.

Merging

• auto-merge: all (owner Settings in pid1/.github, upkeep PRs)
• left for a maintainer: the PR carries a cooldown exception for Node 24.22.1

Needs you

• Review the cooldown exception for Node 24.22.1 (CVE-2026-105481, CVE-2026-105482, CVE-2026-105483, CVE-2026-106069, CVE-2026-106073, CVE-2026-106074, CVE-2026-111497). Sadr lifts the cap after 2026-10-28T10:38Z.

Verification

• node --check on verify.mjs, vectors/check.mjs and coverage.mjs (Node 24.22.1): passed
• node coverage.mjs: "OK — spec and verifier agree", 48 assertions
• node vectors/check.mjs --big --koreader <koreader/test-data at c3b5d06>: 10 passed, 0 failed
• node verify.mjs --help: exit 2, as CI expects
• sh reference-server/run.sh start with the pinned image, then node verify.mjs … --strict-accept --second-user ciuser2 as the CI reference job runs it: conformant, 49 passed, 0 MUST failures, 2 SHOULD failures (same as the README table)
• pins.py check .github/workflows/*.yml: no problems
• gitleaks git on the full history and on this branch: no leaks
• semgrep ci --dry-run on main and on this branch: the same 3 findings, all already triaged in Semgrep

Run

• 11 minutes, US$1.98 (one session for the whole repo, both PRs)

Not done or not checked

• The weekly schedule run of conformance.yml existed to notice a change in koreader/kosync:latest. With the digest pin, a new reference image reaches CI only when a later Sadr run moves the digest, after a 7-day cooldown. If you want the image to float, add a ### Don't touch line for it to AGENTS.md.

---

Opened by Sadr, a dark factory for software.