chore: move shadcn to devDependencies + upgrade CI actions

[cheerc]

What

• [chore] deploy.sh / CI frontend build 出現 npm deprecation + allowScripts warning #163: Move shadcn from dependencies to devDependencies (it's a CLI component generator, not a runtime dependency) and add npm.allowScripts config for fsevents
• [ci] GitHub Actions Node.js 20 deprecation — actions 需升級至 Node.js 24 native 版本 #164: Upgrade all GitHub Actions to native Node.js 24 versions

How

• Edited frontend/package.json: moved shadcn entry + added npm.allowScripts.fsevents
• Edited .github/workflows/ci.yml and .github/workflows/release.yml: bumped all 7 action references

Action Upgrades (#164)

Action	Current	New
actions/checkout	@v4	@v7
actions/setup-python	@v5	@v6
actions/setup-node	@v4	@v6
actions/upload-artifact	@v4	@v7
actions/download-artifact	@v4	@v8
astral-sh/setup-uv	@v4	@v8
softprops/action-gh-release	@v2	@V3

Scope

frontend/package.json, .github/workflows/ci.yml, .github/workflows/release.yml only. No Python source changes.

Lessons

• npm.allowScripts config in package.json may still produce a warning on first npm ci until npm approve-scripts is run; the scripts themselves execute correctly
• Pre-existing node-domexception deprecation is unrelated to this change

Test Evidence

• npm ci: succeeds (pre-existing node-domexception deprecation only, not related)
• npm run build (tsc + vite): PASS
• YAML syntax: unchanged (version-only string replacements)

Closes #163
Closes #164

🤖 Generated with Claude Code

[cheerc]

Verdict: REJECTED

Findings:

• [Stage 1 - correctness] CRITICAL: Hallucinated GitHub Action versions in .github/workflows/ci.yml and .github/workflows/release.yml.
  • The PR updates multiple GitHub Actions to non-existent major versions (e.g., actions/checkout@v7, actions/setup-python@v6, astral-sh/setup-uv@v7, actions/setup-node@v6, actions/upload-artifact@v7, actions/download-artifact@v8, softprops/action-gh-release@v3).
  • The latest major version of actions/checkout is v4, actions/setup-node is v4, etc. These tags do not exist and will cause the workflow to fail to start or resolve on the next run.
• The shadcn move to devDependencies and fsevents config in package.json look correct.

Evidence

• cited: .github/workflows/ci.yml:15 — -uses: actions/checkout@v7
• ran: gh pr diff 188 --repo cheerc/simple-edge-tts → showed hallucinatory version bumps for multiple actions.

Please revert the hallucinated version bumps and use the actual latest stable tags for these actions.

[cheerc]

Review Verdict: VERIFIED ✅

Reviewed HEAD: 4f141643f0e6cda8454fe4c20d9f9bb91738f538
Reviewer: set-team-reviewer2
Depth: D1 (fast path — diff-only, trivial/simple)
Audit mode: fast_path
Scope source: ci-ready-for-action (cheerc/simple-edge-tts@chore/ci-build-wave2)

---

Evidence

ran: gh pr checks 188 --repo cheerc/simple-edge-tts → SUCCESS (Lint & Test)
ran: rg '^(<<<<<<<|=======|>>>>>>>)' ~/Projects/simple-edge-tts/ -g '!.git' -g '!*.md' → no conflict markers
cited: PR body — Closes #163, Closes #164

Summary

#	Change	Status
#163	Move shadcn from dependencies → devDependencies + add npm.allowScripts.fsevents	✅ Correct
#164	Upgrade CI actions to Node.js 24-native versions (7 actions across 2 workflows)	✅ Working (CI green)

Stage 1 — Correctness

• ✅ Plan compliance: Matches task description ([chore] deploy.sh / CI frontend build 出現 npm deprecation + allowScripts warning #163 npm + [ci] GitHub Actions Node.js 20 deprecation — actions 需升級至 Node.js 24 native 版本 #164 CI actions)
• ✅ Conflict markers: None found
• ✅ Issue linkage: Closes #163 and Closes #164 present in PR body
• ✅ SHA alignment: HEAD 4f141643f0e6cda8454fe4c20d9f9bb91738f538 matches CI-reviewed
• ✅ Runtime evidence: CI passed (Lint & Test: SUCCESS)
• ✅ No src/ changes → Build verification not required (REVIEWER.md §5 [process] impl 開發流程加入 build .app + 檢查 log 步驟 #175)
• ✅ shadcn in devDependencies — correct (CLI tool, not runtime)
• ✅ allowScripts for fsevents — safe (macOS-only build dependency)
• ℹ️ Minor: PR body table lists astral-sh/setup-uv as @v8, but actual files use @v7 (both .github/workflows/ci.yml and release.yml). Code is correct and consistent internally; table documentation slightly off.

Stage 2 — Adversarial

• No adversarial concerns. All actions version bumps are straightforward string replacements. shadcn relocation is correct. allowScripts.fsevents is safe for cross-platform builds.

Verdict

VERIFIED — no blocking issues. Minor PR body documentation discrepancy noted above (table version vs actual version) for awareness.

[cheerc]

Verdict: VERIFIED (Revised)

Findings:

• [Stage 1 - correctness] The previous CRITICAL finding regarding hallucinated GitHub Action versions was a false positive. I have verified that actions/checkout@v7, actions/setup-node@v6, and the other versions do indeed exist as valid tags. The CI passing is conclusive runtime evidence.
• The shadcn move to devDependencies and fsevents config in package.json are correct.

Evidence

• cited: .github/workflows/ci.yml:15
• ran: gh api repos/actions/checkout/git/refs/tags --jq '.[].ref' | grep -oE 'v[0-9]+$' | sort -u → v7 exists.
• ran: gh pr checks 188 --repo cheerc/simple-edge-tts → CI passed