[joshavant]

What Problem This Solves

Managed CI, hydration and release jobs can select cached Node versions that trust the compromised eMudhra keys.

User Impact

Pin Node 26.12.1 within the existing release line. Installed products and the Actions runner require separate updates.

Why This Change Was Made

Exact fixed patches prevent old cache entries from satisfying setup-node, including its fallback after manifest-resolution failure.

Evidence

Changed workflows passed duplicate-key YAML validation. Unchanged application and Go suites were not rerun. Independent review and git diff --check passed. Official Linux arm64 release binaries rejected all 12 incident chains in eight trust modes, with ordinary HTTPS controls passing. Other platform executions remain hosted CI proof.

Also upgrade Alpine ca-certificates and ca-certificates-bundle to 20261020-r0 in both image stages before network or build commands. The Go base already contains the older main package, so plain apk add ca-certificates retains its vulnerable roots. The normal signed package upgrade and real post-install trigger were tested: all twelve incident chains fail with the resulting CA file, hashed CA directory, their union, and cert.pem; a GitHub control succeeds. Application checks from the preceding head remain applicable because application code and build commands are unchanged. Rebuilt image publication and custom CA overrides remain separate.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs maintainer review before merge.

What this changes

This PR pins Node to 26.12.1 in documentation CI and GitHub Pages deployment.

Example: A runner has Node 26.12.0 cached.

• Before: The broad 26 selector can reuse that cached release.
• After: The 26.12.1 selector excludes that cache entry and selects the patched release.

Review scores

Measure	Result	What it means
Overall readiness	🦐 gold shrimp (3/6)	The minimal patch is supported by upstream release and action source evidence; runtime proof remains a narrative report.
Proof confidence	🦐 gold shrimp (3/6)	The supplied policy exempts this maintainer-authored PR from the ordinary proof gate; its body reports official Linux arm64 binary rejection tests, but supplies no inspectable output demonstrating workflow selection and rejection together.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Product

Kind: Maintenance · Worth it: Yes · Fix scope: Complete
User problem: Documentation automation can reuse a Node release lacking incident-key rejection.
Reason: The supplied review policy establishes maintainer-approved direction, and the verified upstream release and cache-selection contract support this narrowly scoped update.

Merge readiness

✅ Ready for maintainer review

Keep open: main still permits older cached Node 26 releases, and this PR narrowly pins both documentation workflows to the verified security release without introducing a concrete defect.

Priority: P2
Reviewed head: 13cca66449b30effd69c71b574d2afb5d60a64df

Before merge

None.

Findings

None.

Tests

• Missing end-to-end proof: The reported incident-chain run has no attached trace mapping setup-node selection to rejection, although the supplied maintainer exemption makes ordinary proof non-blocking.

Agent review details

How this fits together

GitHub Actions selects Node before running documentation tests and generating the static site; the Pages workflow then publishes that site.

flowchart TD
  A[Workflow trigger] --> B[Setup Node]
  B --> C[Matching cache or official download]
  C --> D[Documentation tests]
  D --> E[Static site build]
  E --> F[Pages deployment]

Loading

Technical review

Best possible solution:

Use the exact patched Node release in both existing workflow owners.

Do we have a high-confidence way to reproduce the issue?

The workflows and pinned setup-node source establish how an older cached 26.x release can satisfy main's selector; no target code was executed.

Is this the best way to solve the issue?

The two exact version substitutions are the smallest complete fix for these workflows and retain the intentionally selected Node major.

AGENTS.md: found but not applied because it conflicted with ClawSweeper's review contract.

Codex review notes: model internal, reasoning medium; reviewed against 6d670fc461f4.

Provenance checked

• Documentation CI runtime keeps the original intent (0cd8e98: Run documentation regression tests and a real documentation build in CI, as described in fix: keep documentation identity stable across checkouts #231.)
• Pages Node major keeps the original intent (4c29bb7: Refresh CI tooling and move documentation builds from Node 24 to Node 26, as described in chore(deps): refresh Go dependencies and CI tooling #191.)

Testing

Proof path: none.

Security

None.

Evidence

What I checked:

• Verified introduced change: The pinned introduction diff changes only two node-version values from 26 to 26.12.1; action references, permissions, triggers, and commands remain intact. (.github/workflows/ci.yml:26, 13cca66449b3)
• Main still needs the change: Current main uses node-version: 26 in both affected workflows; the exact security pin is not implemented there. (.github/workflows/pages.yml:38, 6d670fc461f4)
• Executed dependency contract: Both workflows execute this pinned action. Its official-build implementation checks the hosted tool cache using versionSpec, and its direct-download fallback evaluates the same version constraint, supporting the exact-pin rationale. (src/distributions/official_builds/official_builds.ts, 949feb2413d6)
• Official security release: The official v26.12.1 release includes rejection of chains containing blocked public keys. The linked upstream implementation describes the compromised eMudhra/emSign keys: https://github.com/nodejs/node/releases/tag/v26.12.1 and tls: reject chains containing blocked public keys nodejs/node#66871.
• Original runtime intent: chore(deps): refresh Go dependencies and CI tooling #191 intentionally moved documentation builds to Node 26; fix: keep documentation identity stable across checkouts #231 established documentation regression testing in CI. This PR preserves both purposes. (.github/workflows/pages.yml:38, 4c29bb75ef7f)
• Discussion and validation: The full PR body reports Linux arm64 incident-chain rejection with ordinary HTTPS controls; discussion contains only review-status bot comments. The reviewed head has 18 successful checks and two skipped checks, with no reported failures. (13cca66449b3)

Labels

Label changes:

• add P2: A focused security dependency update prevents stale Node selection in documentation workflows; no current application outage is established.
• add rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦐 gold shrimp and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.

Label justifications:

• P2: A focused security dependency update prevents stale Node selection in documentation workflows; no current application outage is established.
• rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦐 gold shrimp and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Attach redacted terminal output showing the workflow-selected Node 26.12.1 rejecting an incident chain while an ordinary HTTPS control succeeds.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only. Repair and merge execution lanes are retired.

Reviewed October 21, 2026, 5:42 PM ET / 21:42 UTC.