[mk3008]

Summary

• Pin CI target runtimes to Node 22.23.4 / 24.22.1, including the composite publish-runtime default. These releases contain the eMudhra/emSign blocked-public-key mitigation (Node #66871); exact patches prevent older cached 22/24 builds from satisfying the selection.
• Explicitly retire the EOL Node 20 compatibility lane. Keep the 22/24 core compatibility matrix and move both former Node-20-only coverage and test-evidence/consumer gates intact to 22.23.4. Preserve benchmark jobs, parser PR benchmark, continue-on-error policy, triggers, permissions and scripts.
• Run documentation, manual integration, PR quick checks and demo rebuilds on 22.23.4. Pin publish/readiness targets to 24.22.1. No engines, dependency, public API, SQL/AST/model, CLI, scaffold or generated-asset changes; Actions' embedded runtimes are unchanged.
• Node 20 benchmark history has a different runtime envelope; new Node 22 numbers must not be treated as identical-runtime comparisons. No release/publish/manual deployment dispatch or merge is requested.

Verification

Acceptance item	Status	Repository evidence	Gap
Patched Node selection	done	Nine workflow/action files pin 22.23.4/24.22.1; actual CI job logs confirm both patched versions	Manual-only workflow paths were not executed
Preserve operational gates	done	Both former 20.x conditions now select 22.23.4; coverage, heavy consumers and benchmark steps remain	Node 20 compatibility itself is explicitly retired
Preserve product contracts	done	Changed files are restricted to .github workflows and composite action	No product runtime compatibility claim beyond CI results
Runtime validation	done	CI (both core lanes and all three OS consumer jobs), PR Check and Release Readiness passed for c1e3cd7	Full local baseline not run; this claim is limited to the executed PR checks
No merge/release/publish	done	Branch-only change; existing manual/main triggers unchanged	Manual integration/docs/publish/demo paths are not executed by this PR

Supplementary evidence: before/after YAML was parsed and compared, allowing only Node selections, gate predicates and display/comment updates; both exclusive gates and benchmark retention were checked. The final body was validated with the repository readiness functions using the actual changed-file list. Existing local repositories were inaccessible and Git transport failed, so no local baseline or local Git-dependent readiness command is claimed. The actual Git-dependent PR readiness command passed in GitHub PR Check. Current remote main was used and local changes were untouched. Existing open #981/#982 do not touch workflows; previously merged fixes are not reimplemented.

Merge Readiness

• No baseline exception requested.
• Baseline exception requested and linked below.

Tracking issue: User-requested eMudhra CI remediation; upstream nodejs/node#66871.
Scoped checks run: YAML semantic diff, gate/matrix preservation, exact changed-file list, repository PR-body validation functions; CI, PR Check and Release Readiness all passed at c1e3cd7.
Why full baseline is not required: No baseline waiver is requested. No product files changed. Existing required PR CI passed for the patched runtime selection and retained gates; full local verification remains unavailable and is not claimed.

Self Review

Self-review workflow: rawsql-task-orchestrator impact routing, acceptance-planning, pr-readiness, changeset-classification, consistency and concept-boundary review, pre-pr-retro-gate and human-acceptance review over this exact diff/body.
Self-review result: Version/gate consistency and executed CI checks have no remaining blocker; final consistency, concept-boundary, pre-PR retro and human-acceptance reviews were repeated against these results. The missing minimal-orchestration helper was reported and the requester explicitly instructed the already delegated worker to continue; it is not claimed as executed. No tracked retro item is present; the local task retro CI completion item is resolved by the successful runs.
Concept-review workflow: Explicit no-concept-impact review against root AGENTS and workflow-only changed paths.
Concept-review result: No Concept, Process, DFD, package boundary, SQL, AST, model or human-owned meaning changes.

CLI Surface Migration

• No migration packet required for this CLI change.
• CLI/user-facing surface change and migration packet completed.

No-migration rationale: Only CI Node targets and corresponding lane predicates/comments change.
Upgrade note: No product CLI upgrade is introduced.
Deprecation/removal plan or issue: The EOL Node 20 CI lane is retired; product engines and API remain unchanged.
Docs/help/examples updated: No product commands, help or examples change.
Release/changeset wording: no-release; repository-only CI maintenance. Apply the existing no-release label for publish-workflow guardrail classification; keep publish smoke enabled.

Scaffold Contract Proof

• No scaffold contract proof required for this PR.
• Scaffold contract proof completed.

No-proof rationale: No scaffold generator/template/output changes.
Non-edit assertion: Product and scaffold paths are unchanged.
Fail-fast input-contract proof: Existing input contracts remain unchanged.
Generated-output viability proof: Existing consumer and release-readiness checks remain enabled.

Final CI evidence

• CI passed: Node v22.23.4 / v24.22.1 core lint/build/test (2,553 passed and 1 existing skipped test per lane); coverage and test-evidence/consumer gates both succeeded on 22.23.4; customer consumer guards succeeded on Ubuntu, macOS and Windows.
• PR Check passed: actual Git-based readiness contract, core checks, parser benchmark and package pack.
• Release Readiness passed using Node v24.22.1, including publish smoke/dist/export checks. No publish occurred.
• Main-only benchmark job was skipped as designed for pull_request; its benchmark step and trigger remain intact. Manual integration/docs/demo/release/publish workflows were not dispatched. No full local baseline claim is made.
• Remote read-back matched all nine reviewed changed files. Existing open dependency PRs have no workflow overlap. No package Changeset is added for this repository-only no-release change.

Summary by CodeRabbit

• Chores
  • Updated automated checks, documentation builds, and integration workflows to use Node.js 22.23.4.
  • Publishing workflows now use Node.js 24.22.1.
  • CI compatibility checks now use the specific Node.js versions 22.23.4 and 24.22.1; coverage and validation runs are limited to Node.js 22.23.4.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: d8d45a71-4448-4647-b5d3-7aaa3d53e012

📥 Commits

Reviewing files that changed from the base of the PR and between 6468bce and c1e3cd7.

📒 Files selected for processing: 9

• .github/actions/setup-publish-runtime/action.yml
• .github/workflows/ci.yml
• .github/workflows/docs.yml
• .github/workflows/integration.yml
• .github/workflows/pr-check.yml
• .github/workflows/publish.yml
• .github/workflows/refresh-demo-bundle.yml
• .github/workflows/release-pr.yml
• .github/workflows/release-readiness.yml

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

📝 Walkthrough

CI, validation, and publishing workflows now specify exact Node.js versions. The changes replace version ranges and floating versions with Node.js 22.23.4 and 24.22.1.

Changes: Node.js runtime pins

Layer / File(s)	Summary
CI matrix and validation lanes .github/workflows/ci.yml	The CI matrix now uses Node.js 22.23.4 and 24.22.1. Coverage, consumer validation, the customer-consumer guard, and benchmarks now use Node.js 22.23.4.
Node.js 22 workflow configuration .github/actions/setup-publish-runtime/action.yml, .github/workflows/docs.yml, .github/workflows/integration.yml, .github/workflows/pr-check.yml, .github/workflows/refresh-demo-bundle.yml, .github/workflows/release-pr.yml	The publish-runtime action default and the listed workflows now use Node.js 22.23.4.
Node.js 24 publishing configuration .github/workflows/publish.yml, .github/workflows/release-readiness.yml	All four publish jobs and the release-readiness workflow now use Node.js 24.22.1.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Other

Merge Risk: ⚪ Minimal · up to c1e3c

CI and publishing use exact Node.js releases containing the intended TLS mitigation. No concrete issue remains to block merging.

Pre-merge checks: 5

Check name	Status	Explanation
Title check		The title clearly and concisely describes the main change: pinning patched Node.js runtimes in CI.
Description check		The description follows the required template and provides complete summary, verification evidence, merge-readiness details, self-review results, migration assessment, and scaffold-proof assessment.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (9 skipped: 9 unsupported.)

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}