Merge train 206: the three gap regressions keeping main red, Node pin, zizmor trigger (v0.5.1584)

.github/workflows/gate-failure-watch.yml

@@ -6,7 +6,31 @@ name: Scheduled Gate Failure Watch
 # update the same issue with the current rows and their delta; the next green
 # closes it.
 
-on:
+# zizmor flags `workflow_run` categorically -- "almost always used
+# insecurely", at Medium audit confidence. The two ways it IS used insecurely
+# are both closed here, in code, and each is checkable in one line:
+#
+#   1. It never runs for untrusted input. The `observe` job's `if:` admits only
+#      `schedule`, or `workflow_dispatch`/`repository_dispatch`/`push` whose
+#      head_branch is `main` or a `v*` tag. A fork PR's run satisfies none of
+#      those, so the write-capable token is never reachable from a
+#      contributor-controlled trigger.
+#   2. It never executes the triggering run's code. The checkout pins
+#      `ref: main` with `persist-credentials: false`, and the only thing run is
+#      `scripts/gate_failure_watch.py` out of that trusted default-branch
+#      checkout. Nothing is taken from the triggering run -- no artifact
+#      download, no `head_sha` checkout.
+#
+# Permissions are `actions: read`, `contents: read`, `issues: write`: enough to
+# read a run's conclusion and file one issue, nothing more.
+#
+# Dropping the trigger is not an alternative -- observing another workflow's
+# completion IS the feature (#9830 measured a correctly-failing scheduled
+# workflow staying red for nineteen days with nobody noticing).
+#
+# Ratchet: if this workflow ever gains an artifact download, a `head_sha`
+# checkout, or a looser `if:`, delete the marker and let the gate fail.
+on: # zizmor: ignore[dangerous-triggers]
   workflow_run:
     workflows:
       - Auto-Optimize App Patterns

.github/workflows/test.yml

@@ -1034,6 +1034,22 @@ jobs:
         run: |
           rm -rf target/perry-auto-* target/debug/libperry_ext_*.a 2>/dev/null || true
 
+      # This job runs `cargo test -p perry`, whose integration tests shell out
+      # to node scripts under scripts/ -- and those scripts assert
+      # `process.versions.node` equals the .node-version pin, because the
+      # loader/byte behaviour they gate on is version-specific. Without this
+      # step the job inherits whatever node the ubuntu-latest image happens to
+      # ship (22.23.2 on 2026-09-16), so
+      # `bun_embedded_compression::standalone_compressed_asset_regression`
+      # fails that assertion and takes the whole job red on main. Pinned from
+      # the FILE, never a literal: check_node_version_consistency.py (a lint
+      # step) requires every literal `node-version:` to be a registered
+      # exemption, and this is not one.
+      - name: Setup Node.js for the node-backed integration tests
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
+        with:
+          node-version-file: .node-version
+
       - name: Run cargo test
         # The exclusions below are maintained once in
         # workspace-architecture.json and consumed by ci_test_scope.py:
@@ -1296,6 +1312,18 @@ jobs:
         run: |
           rm -rf target/perry-auto-* target/debug/libperry_ext_*.a 2>/dev/null || true
 
+      # Same reason as the `cargo-test` job: these shards run `-p perry`
+      # integration tests that shell out to node scripts asserting
+      # `process.versions.node` equals the .node-version pin. Which shard a
+      # node-backed test lands in is decided by ci_cargo_test_shard.py, so
+      # leaving this job unpinned makes the failure move with the sharding
+      # rather than stay fixed. From the FILE, not a literal — see
+      # check_node_version_consistency.py.
+      - name: Setup Node.js for the node-backed integration tests
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
+        with:
+          node-version-file: .node-version
+
       - name: Run perry integration shard ${{ matrix.shard }}
         env:
           CARGO_TARGET_X86_64_UNKNOWN_LINUX_GNU_RUSTFLAGS: "-C linker-features=-lld"

CLAUDE.md

@@ -8,7 +8,7 @@ This file provides guidance to Claude Code (claude.ai/code) when working with co
 
 Perry is a native TypeScript compiler written in Rust that compiles TypeScript source code directly to native executables. It uses SWC for TypeScript parsing and LLVM for code generation.
 
-**Current Version:** 0.5.1583
+**Current Version:** 0.5.1584
 
 
 ## TypeScript Parity Status