From c0061f088ff05dc673a9650cc9d2759e373b2136 Mon Sep 17 00:00:00 2001
From: hanxudong159 <42986190+han-xudong@users.noreply.github.com>
Date: Mon, 12 Oct 2026 10:39:32 +0800
Subject: [PATCH] build: update CI actions and align Node type update policy

---
 .github/dependabot.yml   | 3 +++
 .github/workflows/ci.yml | 4 ++--
 CONTRIBUTING.md          | 2 ++
 3 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index c96d582..d243baf 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -8,6 +8,9 @@ updates:
       time: '04:00'
       timezone: Asia/Shanghai
     open-pull-requests-limit: 3
+    ignore:
+      - dependency-name: '@types/node'
+        update-types: ['version-update:semver-major']
     groups:
       npm-minor-and-patch:
         patterns:
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 21a5fd3..8fdbe3e 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -21,12 +21,12 @@ jobs:
         with:
           persist-credentials: false
 
-      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
+      - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
         with:
           version: 11.18.0
           run_install: false
 
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: 22
           cache: pnpm
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index db462d9..47b46d8 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -15,6 +15,8 @@ corepack pnpm install --frozen-lockfile
 
 Start the local development server with `corepack pnpm start`. Run the complete gate with `corepack pnpm check`. The site uses TypeScript 7 for CLI type checking with a standalone `tsconfig.json`; keep its site path mappings relative to the project root and do not reintroduce the removed `baseUrl` option.
 
+Keep @types/node on the Node.js 22 runtime line used by CI and Cloudflare. Update its major only together with the supported runtime and deployment configuration.
+
 ## Content boundaries
 
 Use this site for complete user journeys, installation, task guides, shared concepts, C++ and Python API references, CLI and ROS contracts, operations, and cross-component troubleshooting. Keep implementation internals, release mechanics, and maintainer-only procedures in the repository that owns them. Mechanical interface facts in References come from pinned source manifests; behavioral explanations must still be verified against implementation rather than copied from a README blindly.