chore(ci): bump actions/setup-node from 4.4.0 to 6.4.0

[dependabot]

Bumps actions/setup-node from 4.4.0 to 6.4.0.

Release notes

Sourced from actions/setup-node's releases.

v6.4.0

What's Changed

Dependency updates:

• Upgrade @​actions dependencies by @​Copilot in actions/setup-node#1525
• Update Node.js versions in versions.yml and bump package to v6.4.0 by @​priya-kinthali in actions/setup-node#1533

New Contributors

• @​Copilot made their first contribution in actions/setup-node#1525

Full Changelog: actions/setup-node@v6...v6.4.0

v6.3.0

What's Changed

Enhancements:

• Support parsing devEngines field by @​susnux in actions/setup-node#1283

When using node-version-file: package.json, setup-node now prefers devEngines.runtime over engines.node.

Dependency updates:

• Fix npm audit issues by @​gowridurgad in actions/setup-node#1491
• Replace uuid with crypto.randomUUID() by @​trivikr in actions/setup-node#1378
• Upgrade minimatch from 3.1.2 to 3.1.5 by @​dependabot in actions/setup-node#1498

Bug fixes:

• Remove hardcoded bearer for mirror-url @​marco-ippolito in actions/setup-node#1467
• Scope test lockfiles by package manager and update cache tests by @​gowridurgad in actions/setup-node#1495

New Contributors

• @​susnux made their first contribution in actions/setup-node#1283

Full Changelog: actions/setup-node@v6...v6.3.0

v6.2.0

What's Changed

Documentation

• Documentation update related to absence of Lockfile by @​mahabaleshwars in actions/setup-node#1454
• Correct mirror option typos by @​MikeMcC399 in actions/setup-node#1442
• Readme update on checkout version v6 by @​deining in actions/setup-node#1446
• Readme typo fixes @​munyari in actions/setup-node#1226
• Advanced document update on checkout version v6 by @​aparnajyothi-y in actions/setup-node#1468

Dependency updates:

• Upgrade @​actions/cache to v5.0.1 by @​salmanmkc in actions/setup-node#1449

New Contributors

• @​mahabaleshwars made their first contribution in actions/setup-node#1454
• @​MikeMcC399 made their first contribution in actions/setup-node#1442
• @​deining made their first contribution in actions/setup-node#1446

... (truncated)

Commits

• 48b55a0 Update Node.js versions in versions.yml and bump package to v6.4.0 (#1533)
• ab72c7e Upgrade @​actions dependencies (#1525)
• 53b8394 Bump minimatch from 3.1.2 to 3.1.5 (#1498)
• 54045ab Scope test lockfiles by package manager and update cache tests (#1495)
• c882bff Replace uuid with crypto.randomUUID() (#1378)
• 774c1d6 feat(node-version-file): support parsing devEngines field (#1283)
• efcb663 fix: remove hardcoded bearer (#1467)
• d02c89d Fix npm audit issues (#1491)
• 6044e13 Docs: bump actions/checkout from v5 to v6 (#1468)
• 8e49463 Fix README typo (#1226)
• Additional commits viewable in compare view

[dependabot]

Labels

The following labels could not be found: ci. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[github-actions]

⚠️ Deprecation Warning: The deny-licenses option is deprecated for possible removal in the next major release. For more information, see issue 997.

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
actions/actions/setup-node	48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e	🟢 5.7	Details Check Score Reason Maintained 🟢 6 8 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 6 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Code-Review 🟢 10 all changesets reviewed Packaging ⚠️ -1 packaging workflow not detected Binary-Artifacts 🟢 9 binaries present in source code CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Security-Policy 🟢 9 security policy file detected Branch-Protection ⚠️ 1 branch protection is not maximal on development and all release branches SAST 🟢 9 SAST tool is not run on all commits -- score normalized to 9

Scanned Files

• .github/workflows/discord.yml

[claude]

Review

Clean Dependabot bump — single-line change in .github/workflows/discord.yml, SHA-pinned with matching # v6.4.0 comment. Nothing to flag on code quality, bugs, performance, or test coverage (no app code touched).

Security

• ✅ SHA pinning preserved (48b55a0…). I verified the SHA matches v6.4.0 on actions/setup-node.
• ✅ No secrets or permission changes in this workflow step.

Notes on the jump from v4 → v6 (worth a quick sanity check before merging):

• v5 dropped Node 16 support and changed partial-cache-hit behavior. Since this workflow reads the version from apps/discord/.nvmrc, make sure that file pins a version >= 18. If it's on 16, CI will break.
• v6 bumped the internal actions/checkout dep to v6 and made minor changes to the always-auth registry configuration. The cache: 'npm' + cache-dependency-path usage here is unchanged and still supported.
• v6.3.0 added devEngines parsing for node-version-file: package.json. Not applicable here (we use .nvmrc), so no behavior change.

Recommendation
Approve once the discord job passes green on this PR — that's the full signal that the Node version in .nvmrc is still compatible with v6. No other apps use setup-node, so blast radius is limited to the discord workflow.

---

🤖 Generated with Claude Code

[claude]

Review — chore(ci): bump actions/setup-node from 4.4.0 to 6.4.0

Tiny, well-scoped Dependabot bump. One-line change in .github/workflows/discord.yml swapping the actions/setup-node SHA. Recommending approve with a couple of notes.

What looks good

• SHA pinning preserved. 48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e is the v6.4.0 release commit (matches Update Node.js versions in versions.yml and bump package to v6.4.0 actions/setup-node#1533), and the trailing # v6.4.0 comment was updated to match — keeps the supply-chain hardening intact.
• Only consumer updated. actions/setup-node is referenced exactly once across .github/workflows/ (just discord.yml), so no sibling workflows are left behind on the older pin.
• Real validation passed. The discord: Build and Test job — the only one that actually exercises this action — completed successfully on this PR, including the node-version-file: apps/discord/.nvmrc + cache: 'npm' path that's most affected by setup-node internals.
• No code/runtime impact. Pure CI dependency bump; nothing in apps/, shared/, or Go sources is touched, so the linting/test-coverage rules from CLAUDE.md don't apply.

Worth a quick look before merging

1. Major version jump v4 → v6 (skips v5). Skim of the release notes between v4.4.0 and v6.4.0 surfaces two changes worth being aware of, neither of which should affect this usage but are good to confirm:

   • v6.0: bumped Node runtime under the hood; no input-shape changes.
   • v6.3: when using node-version-file: package.json, setup-node now prefers devEngines.runtime over engines.node. This PR uses .nvmrc, so unaffected — but worth knowing if anyone later flips the input over to package.json.
   • v5.0: removed the deprecated always-auth input. Not used in discord.yml, so safe.

2. Failing check: Dependency Age Check (Actions). Not blocking the build job, but it's red on this PR. Worth a glance — if it's flagging a different action (not setup-node) as stale, this PR isn't the cause and can merge; if it's complaining about the new pin's age (unlikely — v6.4.0 is recent), that's a config issue in the age-check workflow itself, not this bump.

3. Out of scope but noting: this repo's CI mostly pins by SHA; a couple of other dependabot bumps for sibling actions may be queued. Merging this in isolation is fine — just calling out that a periodic sweep keeps the age-check workflow happy.

Verdict

LGTM. Low-risk CI hygiene change, the build job that uses the action passes, and the SHA-pin discipline is preserved. Recommend merging once the unrelated age-check failure is triaged (or confirmed unrelated).

[claude]

Review: Dependabot bump actions/setup-node v4.4.0 → v6.4.0

LGTM. Low-risk, scoped change.

What I checked:

• Diff is one line in .github/workflows/discord.yml; the SHA 48b55a0 matches the upstream v6.4.0 tag, and the comment is updated to # v6.4.0 in lockstep with the SHA (good — keeps the pin auditable).
• This is the only actions/setup-node reference in the repo (grep of .github/), so no other workflows need a matching bump.
• apps/discord/.nvmrc pins Node 22.21.0, which is fully supported by setup-node v6.x.

Notes (non-blocking):

• This is a major version jump (v4 → v6). The two breaking changes worth being aware of:
  • v6 runs on Node 24 runtime (action internals only — does not affect the Node version installed for the project).
  • v6.3.0 added support for parsing the devEngines.runtime field in package.json and now prefers it over engines.node when node-version-file: package.json is used. Not a concern here since the workflow points at .nvmrc, not package.json.
• No code, test, or security-surface changes — CI passing is sufficient signal.

Approving on merge once green.