build(actions): enforce reviewed Node 24 artifact upload inventory

[seonghobae]

Purpose

Current protected-main test-first successor for #255. This PR moves retained Noema actions/upload-artifact call sites from deprecated v4.6.2 to the reviewed Node-24-native immutable v7.0.1 commit and proves a newly added workflow use cannot escape the reviewed inventory.

Exact current identity

• protected/live base: fc8f48f649d42b81ecf7fc890ee70aff88690966
• exact current head: 4850bd41a19517246b4f7ff97d59a8be6affdc8e
• branch: fix/upload-artifact-node24-main-v4
• reviewed target: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
• deprecated pin rejected: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02

The production GREEN changes only retained Noema workflow uses: pins/comments and their integrity tests. Artifact names, paths, conditions, retention/compression behavior, permissions, checkout credential posture, release/deployment semantics, package metadata, and central .github remain unchanged.

Strengthened test contract

The regression enumerates every .yml / .yaml file under .github/workflows, discovers every workflow containing actions/upload-artifact@, and requires the discovered set to equal the reviewed supported inventory. Every occurrence must use the exact immutable Node-24 pin; the deprecated immutable pin and floating major tags are rejected.

Restack and verification boundary

The branch was merged with protected main after #272 integrated nanoid@3.3.18. The merge tree was constructed from current protected-main bytes and overlaid only the 12 reviewed PR paths, preserving #272's package lock, lockfile policy, changelog, and regression evidence.

Prior exact-head evidence on 8b5b89a821dc71e9e2957311805aa1bf4d56bb8e—including 127 test files / 1068 tests and 100% owned production statement/branch/function/line coverage—does not transfer to the new head. Application ci, reviewer-ci, protected-base-eligible Security Scan, and fresh review must all complete successfully on unchanged head 4850bd41a19517246b4f7ff97d59a8be6affdc8e before merge. Pending, queued, skipped, absent, neutral, failed, cancelled, stale, predecessor, status-only, model-only, or rate-limited evidence is non-passing.

Related: #255, #271, #272.

[coderabbitai]

Warning

Review limit reached

@seonghobae, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 100 minutes

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 1f0d1feb-425a-4beb-b041-4a6a08567355

📥 Commits

Reviewing files that changed from the base of the PR and between fc8f48f and 4850bd4.

📒 Files selected for processing (12)

• .github/workflows/acquisition-readiness-scan.yml
• .github/workflows/cd.yml
• .github/workflows/central-review.yml
• .github/workflows/hourly-commercial-readiness.yml
• .github/workflows/hourly-product-development.yml
• .github/workflows/maintainer-app-readiness.yml
• .github/workflows/readiness-scan.yml
• .github/workflows/release-evidence.yml
• test/acquisition-readiness-scan-toolchain-integrity.test.ts
• test/hourly-product-development-workflow.test.ts
• test/readiness-scan-toolchain-integrity.test.ts
• test/upload-artifact-node24-integrity.test.ts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

@coderabbitai review

Review exact current head 4850bd41a19517246b4f7ff97d59a8be6affdc8e against protected base fc8f48f649d42b81ecf7fc890ee70aff88690966. Verify the complete discovered upload-artifact inventory, immutable v7.0.1 pin, preserved workflow behavior, and absence of stale v4.6.2/floating-tag uses. Do not transfer conclusions from predecessor heads.

[coderabbitai]

Rate Limit Exceeded

@seonghobae have exceeded the limit for the number of chat messages per hour. Please wait 0 minutes and 0 seconds before sending another message.