build(deps): bump actions/setup-node to v6.5.0, fix composite-action sibling gap - #594
Merged
Conversation
…osite-action sibling gap Dependabot opened PR #563 proposing a major bump to actions/setup-node v7.0.0, but only updated ci.yml's one direct `uses:` reference. The repo has two more references Dependabot's github-actions ecosystem scanner structurally cannot see (it only scans .github/workflows/*.yml, not composite action definitions under .github/actions/): the shared .github/actions/setup/action.yml composite (used by the security and quality jobs -- the substantive CI work) and the disabled Cloudflare Pages deploy workflow. Merging #563 as-is would have left the small workflow-policy job's bootstrap on v7 while every other job's actual setup-node execution stayed on v6.4.0 -- exactly the sibling-reference drift class this repo's own DEPENDABOT-TRIAGE.md already documents an incident for with codeql-action, just via a different root cause (a Dependabot scanner blind spot rather than a missing group config). Compared v7.0.0 against the parallel v6.5.0 release (published five minutes apart, confirmed via the GitHub Releases API) before choosing either: v7.0.0's changelog is an ESM migration (invisible to a plain `uses:` consumer), new unused cache-key outputs, a mirrorToken fix for an input this repo never sets, and removal of a dummy NODE_AUTH_TOKEN export this repo never reads -- zero functional benefit here, for the review burden of a major bump. v6.5.0 backports the one change that does matter, @actions/cache 5.1.0 plus security overrides for undici and fast-xml-parser, onto the existing v6.x line with no other change. Bumped all three references (ci.yml, the composite action, and the disabled Cloudflare workflow, kept consistent for whenever it's re-enabled) to the verified v6.5.0 commit SHA. PR #563 closed in favor of this PR, with the full comparison recorded there.
🤖 CodeAnt AI — Review Status
|
Thanks for using CodeAnt! 🎉We're free for open-source projects. if you're enjoying it, help us grow by sharing. Share on X · |
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
PR Summary
|
Reviewer's guide (collapsed on small PRs)Reviewer's GuideUpdates all tracked actions/setup-node references—including the composite action missed by Dependabot and a disabled deployment workflow—from v6.4.0 to the verified v6.5.0 commit, keeping CI references aligned while taking the release’s security fixes without the v7 major-version migration. File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
codeant-ai
Bot
added
the
size:XS
🏁 CodeAnt Quality Gate ResultsCommit: ✅ Overall Status: PASSEDQuality Gate Details
|
![amazon-q-developer[bot]](https://avatars.githubusercontent.com/in/1220912?s=60&v=4){kind=small}
There was a problem hiding this comment.
This PR correctly updates actions/setup-node from v6.4.0 to v6.5.0 across all workflow files. The changes are consistent, properly SHA-pinned, and well-tested according to the PR description. No blocking issues identified.
You can now have the agent implement changes and create commits directly on your pull request's source branch. Simply comment with /q followed by your request in natural language to ask the agent to make changes.
![codescene-access[bot]](https://avatars.githubusercontent.com/in/3755875?s=60&v=4){kind=small}
There was a problem hiding this comment.
No application code in the PR — skipped Code Health checks.
See analysis details in CodeScene
Quality Gate Profile: The Bare Minimum
Install CodeScene MCP: safeguard and uplift AI-generated code. Catch issues early with our IDE extension and CLI tool.
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Essentials Run ID: 📒 Files selected for processing (3)
Included review availability: 0 reviews are currently available. Your included PR review attempts over the past 7 days set your current allowance at 1 review per hour. 📝 WalkthroughWalkthroughThe pull request updates all listed ChangesNode action update
Estimated code review effort: 1 (Trivial) | ~2 minutes Merge Risk: ⚪ Minimal · up to The automation dependency pin update consistently moves all listed setup-node references to v6.5.0 while retaining immutable SHA pins. No current merge-blocking risk is identified. 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
Full details: Docstring CoverageExplanation No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (3 skipped: 3 unsupported.) ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
 |
|
Overall Grade |
Security Reliability Complexity Hygiene |
Code Review Summary
| Analyzer | Status | Updated (UTC) | Details |
|---|---|---|---|
| Docker |  |
Sep 3, 2026 12:59p.m. | Review ↗ |
| Python | |
Sep 3, 2026 12:59p.m. | Review ↗ |
| Rust | |
Sep 3, 2026 12:59p.m. | Review ↗ |
| Shell | |
Sep 3, 2026 12:59p.m. | Review ↗ |
Important
AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
qnbs
added a commit
that referenced
this pull request
Sep 3, 2026
… check-pr-size.mjs exception-ceiling bug Recomputed entirely from a genuine rebase of #583 onto current main (which now carries #562, #592, and #594) rather than trusting the historical 70 files / 1753 lines / 21 commits figures the earlier commits on this branch carried forward. The rebase itself revealed two things the prior estimate could not have known: 1. #583 and #592 (the independent factory-reset persistence-admission fix, issues #591/#593) touch overlapping files -- app/listenerMiddleware.ts, services/factoryResetService.ts, services/crossProjectIndexService.ts, and their tests. Reconciled by layering both mechanisms inside wipeAllAppData(): #592's isFactoryResetInProgress()/coordinator-draining gate runs first (blocks new Redux-listener writes, drains in-flight ones), then #583's beginIdbReset() force-closes every other long-lived IDB connection the coordinators do not track. 2. PR #590 (merged earlier, unrelated) had already independently shipped the same locale-independent Settings/mobile-"More"-button navigation fix #583 originally introduced across five files (components/SettingsView.tsx, components/settings/SettingsModals.tsx, components/settings/DataSection.tsx, components/Sidebar.tsx, tests/e2e/helpers.ts). Parallel convergent evolution left #583's own changes to those files fully superseded -- zero net diff against current main -- so they are correctly absent from allowedPaths. Final measured diff: 65 governed files (84 incl. generated locale bundles), 1611 meaningful lines, 14 commits -- exact ceilings, no speculative headroom, computed directly via check-pr-size.mjs itself against the real rebased branch. That direct measurement also surfaced a latent bug in check-pr-size.mjs: when an exception's own ceiling legitimately exceeds TIERS.absolute (30 files/3000 lines/15 commits) -- the entire point of granting one -- evaluatePrSize() fell through to selectSeverity() against that fixed tier instead of treating the exception's own ceiling as authoritative, so a fully-satisfied wide exception still reported blocking:true. Neither #539 (maxFiles:30, at the absolute tier's own boundary) nor #564 (maxFiles:3, well under it) had ever exercised this path -- #583 is the first exception whose own scope is wide enough to expose it. Fixed to short-circuit on exception.entry directly, verified against a synthetic base commit carrying this fix plus the recomputed entry, diffed against the actual rebased #583 branch (exit 0, PR_SIZE_EXCEPTION=APPLIED). Added a regression test covering a wide exception ceiling that exceeds the fixed absolute tier. Squashes the prior five commits on this branch (four incremental "recompute" attempts plus a stray temp commit), none of which had been verified against a real rebase or the actual gate behavior.
5 tasks
qnbs
added a commit
that referenced
this pull request
Sep 3, 2026
… check-pr-size.mjs exception-ceiling bug Recomputed entirely from a genuine rebase of #583 onto current main (which now carries #562, #592, and #594) rather than trusting the historical 70 files / 1753 lines / 21 commits figures the earlier commits on this branch carried forward. The rebase itself revealed two things the prior estimate could not have known: 1. #583 and #592 (the independent factory-reset persistence-admission fix, issues #591/#593) touch overlapping files -- app/listenerMiddleware.ts, services/factoryResetService.ts, services/crossProjectIndexService.ts, and their tests. Reconciled by layering both mechanisms inside wipeAllAppData(): #592's isFactoryResetInProgress()/coordinator-draining gate runs first (blocks new Redux-listener writes, drains in-flight ones), then #583's beginIdbReset() force-closes every other long-lived IDB connection the coordinators do not track. 2. PR #590 (merged earlier, unrelated) had already independently shipped the same locale-independent Settings/mobile-"More"-button navigation fix #583 originally introduced across five files (components/SettingsView.tsx, components/settings/SettingsModals.tsx, components/settings/DataSection.tsx, components/Sidebar.tsx, tests/e2e/helpers.ts). Parallel convergent evolution left #583's own changes to those files fully superseded -- zero net diff against current main -- so they are correctly absent from allowedPaths. Final measured diff: 65 governed files (84 incl. generated locale bundles), 1611 meaningful lines, 14 commits -- exact ceilings, no speculative headroom, computed directly via check-pr-size.mjs itself against the real rebased branch. That direct measurement also surfaced a latent bug in check-pr-size.mjs: when an exception's own ceiling legitimately exceeds TIERS.absolute (30 files/3000 lines/15 commits) -- the entire point of granting one -- evaluatePrSize() fell through to selectSeverity() against that fixed tier instead of treating the exception's own ceiling as authoritative, so a fully-satisfied wide exception still reported blocking:true. Neither #539 (maxFiles:30, at the absolute tier's own boundary) nor #564 (maxFiles:3, well under it) had ever exercised this path -- #583 is the first exception whose own scope is wide enough to expose it. Fixed to short-circuit on exception.entry directly, verified against a synthetic base commit carrying this fix plus the recomputed entry, diffed against the actual rebased #583 branch (exit 0, PR_SIZE_EXCEPTION=APPLIED). Added a regression test covering a wide exception ceiling that exceeds the fixed absolute tier. Squashes the prior five commits on this branch (four incremental "recompute" attempts plus a stray temp commit), none of which had been verified against a real rebase or the actual gate behavior.
qnbs
added a commit
that referenced
this pull request
Sep 3, 2026
… check-pr-size.mjs exception-ceiling bug (#586) Recomputed entirely from a genuine rebase of #583 onto current main (which now carries #562, #592, and #594) rather than trusting the historical 70 files / 1753 lines / 21 commits figures the earlier commits on this branch carried forward. The rebase itself revealed two things the prior estimate could not have known: 1. #583 and #592 (the independent factory-reset persistence-admission fix, issues #591/#593) touch overlapping files -- app/listenerMiddleware.ts, services/factoryResetService.ts, services/crossProjectIndexService.ts, and their tests. Reconciled by layering both mechanisms inside wipeAllAppData(): #592's isFactoryResetInProgress()/coordinator-draining gate runs first (blocks new Redux-listener writes, drains in-flight ones), then #583's beginIdbReset() force-closes every other long-lived IDB connection the coordinators do not track. 2. PR #590 (merged earlier, unrelated) had already independently shipped the same locale-independent Settings/mobile-"More"-button navigation fix #583 originally introduced across five files (components/SettingsView.tsx, components/settings/SettingsModals.tsx, components/settings/DataSection.tsx, components/Sidebar.tsx, tests/e2e/helpers.ts). Parallel convergent evolution left #583's own changes to those files fully superseded -- zero net diff against current main -- so they are correctly absent from allowedPaths. Final measured diff: 65 governed files (84 incl. generated locale bundles), 1611 meaningful lines, 14 commits -- exact ceilings, no speculative headroom, computed directly via check-pr-size.mjs itself against the real rebased branch. That direct measurement also surfaced a latent bug in check-pr-size.mjs: when an exception's own ceiling legitimately exceeds TIERS.absolute (30 files/3000 lines/15 commits) -- the entire point of granting one -- evaluatePrSize() fell through to selectSeverity() against that fixed tier instead of treating the exception's own ceiling as authoritative, so a fully-satisfied wide exception still reported blocking:true. Neither #539 (maxFiles:30, at the absolute tier's own boundary) nor #564 (maxFiles:3, well under it) had ever exercised this path -- #583 is the first exception whose own scope is wide enough to expose it. Fixed to short-circuit on exception.entry directly, verified against a synthetic base commit carrying this fix plus the recomputed entry, diffed against the actual rebased #583 branch (exit 0, PR_SIZE_EXCEPTION=APPLIED). Added a regression test covering a wide exception ceiling that exceeds the fixed absolute tier. Squashes the prior five commits on this branch (four incremental "recompute" attempts plus a stray temp commit), none of which had been verified against a real rebase or the actual gate behavior.
This was referenced Sep 3, 2026
qnbs
added a commit
that referenced
this pull request
Sep 5, 2026
* chore(release): bump version to v1.28.4 Patch release reconciling release-truth documentation with everything merged to main since v1.28.3 (62 commits / ~40 PRs, audited against live GitHub state, not assumed from commit subjects): - fix: PWA first-install unprompted reload (#585, PR #613) - fix: shared-origin service-worker cache-read isolation (#514, PR #612) - fix: Factory Reset could reboot into Settings instead of Welcome Portal (PR #592) - fix: preserve-first desktop corruption recovery (PR #542) and a distinct filesystem-I/O recovery action (PR #545) - fix: intentionally cleared project metadata no longer reappears (PR #546) - a11y: Welcome/Home dashboard WCAG AA contrast + reduced-motion cascade fix + default appearance preset change (#565, PR #609); ManuscriptEditor contrast (PR #560) - security: fflate ZIP64-parsing DoS override (PR #595); routine dependency floor bumps (PR #587, #561, #562, #594) - docs: R-15 secure desktop storage design contract admitted (PRs #564, #580, #581, #582, #584) — design only, no implementation yet - tests: visual regression testing repaired — baselines were directory listings, not the application (PR #610); IDB reset-quiescence hardening (PR #596); WelcomePortal E2E navigation made locale-independent (PR #590) Everything classified as pure internal/CI-governance churn (PR-size exception plumbing, dual-graph tooling, toolchain pins) is omitted from CHANGELOG.md as non-user-facing. Version bumped via the existing sync scripts (sync-tauri-version.mjs, sync-sw-version.mjs) across package.json, src-tauri/Cargo.toml, src-tauri/tauri.conf.json, src-tauri/Cargo.lock, AGENTS.md, and public/sw.js's APP_VERSION. CHANGELOG.md and README.md use the established release-candidate marker convention (<!-- release-candidate: v1.28.4 -->) so the dated entry and version badge are truthful before the v1.28.4 tag exists; both markers are removed in a follow-up post-release truth-sync once the tag and GitHub Release are published, matching the v1.28.2/v1.28.3 precedent. TODO.md's Current Sprint section was archived (its final "release cut remains open" bullet is now resolved — v1.28.2 and v1.28.3 both shipped) and replaced with the actual current sprint: this release cut followed by the R-15 desktop at-rest encryption priority program. AUDIT.md is intentionally not touched here — its release-gate entry requires real post-merge CI/CodeQL run evidence that doesn't exist until after this PR merges and the tag is cut, matching how every prior release's AUDIT.md entry was written (a follow-up commit, not part of the release-prep PR itself). * docs(release): correct premature done-marker on the v1.28.4 TODO item TODO.md's Current Sprint marked the release cut as done (checked 'v1.28.4' release cut, reconciling ... AUDIT.md truth ...) while this same PR's own Non-goals section correctly states AUDIT.md is not touched here, and while no tag, GitHub Release, or release artifacts exist yet. Corrected to in-progress language naming PR #615 directly and listing what actually remains pending (tag, release, artifacts, post-release AUDIT.md evidence). * docs(release): correct R-15 gate language and credit PR #596's real fix Two corrections from review, verified against live evidence before fixing: 1. TODO.md's Current Sprint claimed R-15 desktop at-rest encryption implementation was being prioritized now. docs/native/DESKTOP- MIGRATION-ROADMAP-REV3.md explicitly forbids pulling Wave 3/4 R-15 implementation ahead of unresolved Wave 2 authority prerequisites, and CORE-MIGRATION-LEDGER.md row 10 records S5_IMPLEMENTATION_READY=NO. Corrected to state R-15 design is complete but implementation stays gated behind the still-open Wave 2 prerequisite (ledger row 9: the project state-shape compatibility adapter), which is what this sprint's desktop-storage work actually is. 2. CHANGELOG.md listed PR #596 only as generic IDB test hardening under Tests. Verified against its actual diff: deleteDatabase() previously resolved on a genuine onerror or an onblocked event as if deletion succeeded, so wipeAllAppData() could report Factory Reset complete while a database was never actually deleted. onerror now rejects; onblocked waits for the connection to close before giving up. This is a real production data-integrity fix, not test hardening, and now has its own Fixed entry.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
User description
Summary
Supersedes #563. Dependabot proposed a major bump to
actions/setup-nodev7.0.0, but its github-actions ecosystem scanner only covers.github/workflows/*.yml— it cannot seeuses:references inside composite action definitions under.github/actions/. As a result, PR #563 only updatedci.yml's one direct reference (the smallworkflow-policyjob's bootstrap step), leaving two more references at v6.4.0:.github/actions/setup/action.yml— the shared composite action actually used by thesecurityandqualityjobs (the substantive CI work: lint, typecheck, tests, coverage)..github/workflows/deploy-cloudflare-pages.yml.disabled— kept consistent for whenever it's re-enabled.Merging #563 as-is would have left the bootstrap job on v7 while every job that matters stayed on v6.4.0 — the same sibling-reference-drift failure mode
docs/DEPENDABOT-TRIAGE.mdalready documents an incident for withcodeql-action, just caused by a different root cause (a Dependabot scanner blind spot rather than a missinggroups:entry).Why v6.5.0, not v7.0.0
Compared both (published five minutes apart, per the GitHub Releases API) before choosing:
mirrorTokenfix (unused input here), dummyNODE_AUTH_TOKENremoval (unused var here)@actions/cache→ 5.1.0 + security overrides forundiciandfast-xml-parser— the same fix, backportedDEPENDABOT-TRIAGE.md's triage matrixv6.5.0 delivers the one change that matters with none of the major-bump review burden.
Test plan
pnpm run lint— cleanpnpm exec vitest run tests/unit/tooling/workflowPolicyCheck.test.ts— 71/71 pass (action-pin structural validation)pnpm run ci:prepush— full local admission PASS249970729cb0ef3589644e2896645e5dc5ba9c38against the GitHub API resolves to thev6.5.0/v6tags inactions/setup-nodeSummary by Sourcery
Standardize actions/setup-node on v6.5.0 across active and disabled CI configuration.
Bug Fixes:
CI:
Summary by cubic
Updates all
actions/setup-nodereferences from v6.4.0 to v6.5.0 instead of taking the proposed v7 major bump. This provides the relevant dependency security fixes without the v7 migration or behavior changes, while keeping every invocation on the same release.Dependencies
@actions/cacheto 5.1.0 and adds security overrides forundiciandfast-xml-parser..github/actions/.Written for commit ec2dc5f. Summary will update on new commits.
CodeAnt-AI Description
Align all CI workflows on actions/setup-node v6.5.0
What Changed
Impact
✅ Consistent Node.js setup across CI jobs✅ Security fixes for dependency caching and parsing✅ Fewer workflow failures from mismatched action versions💡 Usage Guide
Checking Your Pull Request
Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.
Talking to CodeAnt AI
Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:
This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.
Example
Preserve Org Learnings with CodeAnt
You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:
This helps CodeAnt AI learn and adapt to your team's coding style and standards.
Example
Retrigger review
Ask CodeAnt AI to review the PR again, by typing:
Check Your Repository Health
To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.
Summary by CodeRabbit