From 692b1f79098ad71e3a95223c659195d555b5ad4c Mon Sep 17 00:00:00 2001 From: Antonio Orionus Date: Sat, 8 Aug 2026 12:55:18 +0300 Subject: [PATCH 1/2] chore: make the setup-node contract assertion version-agnostic MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The tooling contract hardcoded `uses: actions/setup-node@v6`, so every setup-node major bump failed the gate — which is exactly what blocked #138 (v6 -> v7). The contract's intent is that Node is set up for registry trusted publishing, not which release of the action does it; node-version: 24 and the registry URL stay asserted because those are the parts that actually matter. Verified the relaxed assertion still fails when setup-node is absent entirely. --- scripts/check-tooling-contract.mjs | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/scripts/check-tooling-contract.mjs b/scripts/check-tooling-contract.mjs index 75ec2e15..d4f52fc2 100644 --- a/scripts/check-tooling-contract.mjs +++ b/scripts/check-tooling-contract.mjs @@ -278,7 +278,10 @@ for (const workflow of publishWorkflows) { assert(text.includes(`run: ${workflow.command}`), `${workflow.path} must call "${workflow.command}".`) assert(text.includes('bun pm view'), `${workflow.path} must use bun pm view for registry version checks.`) assert(text.includes('bun pm pack --destination'), `${workflow.path} must pack artifacts with bun pm pack.`) - assert(text.includes('uses: actions/setup-node@v6'), `${workflow.path} must set up Node for registry trusted publishing.`) + // Version-agnostic on purpose: the contract cares that Node is set up for + // trusted publishing, not which release of the action does it. Pinning the + // major here meant every setup-node bump failed the gate. + assert(/uses: actions\/setup-node@/.test(text), `${workflow.path} must set up Node for registry trusted publishing.`) assert(text.includes('node-version: 24'), `${workflow.path} must use Node 24 for registry trusted publishing.`) assert(text.includes('registry-url: https://registry.npmjs.org'), `${workflow.path} must target the npmjs registry for trusted publishing.`) assert(text.includes('package-manager-cache: false'), `${workflow.path} must keep package-manager caching disabled in publish jobs.`) From 661e655bc1de2a6480064d5969013ef870de3cff Mon Sep 17 00:00:00 2001 From: Antonio Orionus Date: Sat, 8 Aug 2026 12:56:12 +0300 Subject: [PATCH 2/2] chore: use includes() for the setup-node contract assertion The regex form had no regex features, so oxlint's prefer-includes flagged it. Prefix matching on 'uses: actions/setup-node@' is simpler and equally version-agnostic; re-verified it still fails when setup-node is absent. --- scripts/check-tooling-contract.mjs | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scripts/check-tooling-contract.mjs b/scripts/check-tooling-contract.mjs index d4f52fc2..d97b84a1 100644 --- a/scripts/check-tooling-contract.mjs +++ b/scripts/check-tooling-contract.mjs @@ -281,7 +281,7 @@ for (const workflow of publishWorkflows) { // Version-agnostic on purpose: the contract cares that Node is set up for // trusted publishing, not which release of the action does it. Pinning the // major here meant every setup-node bump failed the gate. - assert(/uses: actions\/setup-node@/.test(text), `${workflow.path} must set up Node for registry trusted publishing.`) + assert(text.includes('uses: actions/setup-node@'), `${workflow.path} must set up Node for registry trusted publishing.`) assert(text.includes('node-version: 24'), `${workflow.path} must use Node 24 for registry trusted publishing.`) assert(text.includes('registry-url: https://registry.npmjs.org'), `${workflow.path} must target the npmjs registry for trusted publishing.`) assert(text.includes('package-manager-cache: false'), `${workflow.path} must keep package-manager caching disabled in publish jobs.`)