ci: keep Node24 forcing without tripping scorecard checks

[seonghobae]

Summary

• move FORCE_JAVASCRIPT_ACTIONS_TO_NODE24 out of the scorecard job-level env block and onto the JavaScript-action steps that still need it
• keep the scorecards workflow compatible with Scorecard's default-branch publish verification while preserving Node24 forcing for actions/checkout and github/codeql-action/upload-sarif
• strengthen the workflow runtime regression test so the scorecards exception is verified structurally instead of by brittle step indexes

Verification

• uv run pytest -q
• PYTHONWARNINGS=error uv run pytest -q
• uv run pytest --cov=src/newsdom_api --cov-branch --cov-report=term-missing --cov-fail-under=100 -q
• python3 -c "import yaml, pathlib; [yaml.safe_load(path.read_text(encoding='utf-8')) for path in pathlib.Path('.github/workflows').glob('*.yml')]; print('workflow yaml ok')"

Summary by CodeRabbit

릴리스 노트

• Chores

  • CI/CD 워크플로우 환경 설정 개선 - 환경 변수 구성 최적화

• Tests

  • 워크플로우 환경 설정 검증을 위한 새로운 테스트 추가
  • 기존 테스트 동작 개선

[seonghobae]

@coderabbitai resolve

[seonghobae]

@coderabbitai approve

[seonghobae]

@coderabbitai review

[coderabbitai]

📝 Walkthrough

개요

GitHub 워크플로우 scorecards.yml에서 FORCE_JAVASCRIPT_ACTIONS_TO_NODE24 환경 변수를 작업 수준의 env 블록에서 특정 작업 스텝으로 이동했습니다. 해당 테스트도 업데이트되어 이 변경사항을 검증합니다.

변경사항

Cohort / File(s)	요약
워크플로우 구성 .github/workflows/scorecards.yml	FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true 환경 변수를 작업 수준 env에서 actions/checkout 스텝과 조건부 github/codeql-action/upload-sarif 스텝으로 이동했습니다.
워크플로우 테스트 tests/test_workflow_runtime_env.py	기존 테스트에서 scorecards.yml 워크플로우를 제외하고, 새로운 테스트를 추가하여 해당 워크플로우의 특정 스텝에서 환경 변수가 올바르게 설정되었는지 검증합니다.

예상 코드 리뷰 소요시간

🎯 2 (Simple) | ⏱️ ~10 분

관련 가능성 있는 PR

• ci: keep Node24 forcing without tripping scorecard checks #16: GitHub 워크플로우 YAML에서 FORCE_JAVASCRIPT_ACTIONS_TO_NODE24의 범위 조정 및 관련 테스트 업데이트 (.github/workflows/scorecards.yml과 tests/test_workflow_runtime_env.py 수정)

시

🐰 워크플로우 단계마다 노드를 키우고,
환경 변수를 소복이 배치해,
테스트로 확인하며 안내하니,
깔끔한 구성의 완성이라.
아, 이렇게 정리되니 마음이 놓여! ✨

🚥 Pre-merge checks | ✅ 2 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely summarizes the main change: moving Node24 forcing from job-level env to specific steps while maintaining scorecard compatibility.
Description check	✅ Passed	The description covers the summary of changes, Git Flow target context, comprehensive verification steps, and relevant notes about the implementation approach.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/scorecard-workflow-verification

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

✅ Actions performed

Review triggered.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[coderabbitai]

🧹 Nitpick comments (1)

tests/test_workflow_runtime_env.py (1)

38-47: scorecard job 전체 env 금지 대신 대상 키만 검증하는 편이 더 견고합니다.

현재는 job-level env 자체를 금지해, 향후 무관한 환경변수 추가 시 테스트가 불필요하게 깨질 수 있습니다. 요구사항에 맞게 FORCE_JAVASCRIPT_ACTIONS_TO_NODE24 키 부재만 검증하는 형태가 더 안전합니다.

제안 diff

-    assert "env" not in scorecard_job
+    assert (
+        "FORCE_JAVASCRIPT_ACTIONS_TO_NODE24"
+        not in scorecard_job.get("env", {})
+    )

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@tests/test_workflow_runtime_env.py` around lines 38 - 47, The test currently
asserts that the entire scorecard_job has no "env", which is brittle; update it
to only assert that the specific key "FORCE_JAVASCRIPT_ACTIONS_TO_NODE24" is not
present at job-level and that it is present and True in the step envs: replace
the top-level assert "env" not in scorecard_job with an assertion that
"FORCE_JAVASCRIPT_ACTIONS_TO_NODE24" not in scorecard_job.get("env", {}), and
keep the existing checks on steps_by_name["Checkout"]["env"] and
steps_by_name["Upload SARIF results"]["env"] ensuring that those step env dicts
contain the key and its value is True.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Nitpick comments:
In `@tests/test_workflow_runtime_env.py`:
- Around line 38-47: The test currently asserts that the entire scorecard_job
has no "env", which is brittle; update it to only assert that the specific key
"FORCE_JAVASCRIPT_ACTIONS_TO_NODE24" is not present at job-level and that it is
present and True in the step envs: replace the top-level assert "env" not in
scorecard_job with an assertion that "FORCE_JAVASCRIPT_ACTIONS_TO_NODE24" not in
scorecard_job.get("env", {}), and keep the existing checks on
steps_by_name["Checkout"]["env"] and steps_by_name["Upload SARIF
results"]["env"] ensuring that those step env dicts contain the key and its
value is True.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: fa4d18cd-f114-4008-b6e0-591d70dba2b8

📥 Commits

Reviewing files that changed from the base of the PR and between d726acd and 7cd8550.

📒 Files selected for processing (2)

• .github/workflows/scorecards.yml
• tests/test_workflow_runtime_env.py

[coderabbitai]

✅ Actions performed

Comments resolved and changes approved.

[coderabbitai]

✅ Actions performed

Comments resolved and changes approved.