[joshavant]

The selected Node runtime predates incident-key rejection or uses a floating major that can reuse an older cached runner patch.

Update the existing Node selections to their fixed patch releases. Preserve generic application engine compatibility declarations and existing release/deployment behavior.

Validation: The released Node.js candidates (22.23.4, 24.22.1, 26.12.1) were qualified independently: all eight disclosed SPKIs are present in their rejection policy, and Linux arm64 rejects all twelve incident hosts in eight modes, including affected explicit CA and pre-created SecureContext modes. Ordinary GitHub HTTPS controls pass. This is runtime qualification; it does not attest every architecture or deployed installation. All touched workflow YAML parses. actionlint passes unless the inherited tooling limitation listed below applies. git diff --check passes.

Remaining scope: Application/native build matrices, packaged artifacts and deployments were not run for this selector-only change. Third-party actions execute their own bundled runtimes and remain separately tracked. Existing main/deploy automation can affect a live Worker when a future merge is authorized; this local preparation authorizes no deployment.

No release or deployment was performed. Future merges require separate permission.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs maintainer review before merge.

What this changes

This PR pins all five deployment-workflow Node selections to 24.22.1.

Example: The Deploy workflow prepares its check job.

• Before: setup-node requests the floating version 24.
• After: setup-node requests exactly 24.22.1.

Review scores

Measure	Result	What it means
Overall readiness	🦐 gold shrimp (3/6)	The patch is minimal and has successful exact-head validation; runtime qualification is described in the body without an inspectable linked trace.
Proof confidence	🦐 gold shrimp (3/6)	The supplied maintainer-authored classification exempts this selector update from the ordinary contributor proof gate; the body reports Linux arm64 incident-host rejection and successful GitHub HTTPS controls, while exact-head CI supports workflow compatibility.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Product

Kind: Maintenance · Worth it: Yes · Fix scope: Complete
User problem: Workflow commands can run a Node 24 patch that predates compromised-certificate rejection.
Reason: The supplied maintainer-authored classification authorizes this narrow security direction, and the official release supports the selected patch.

Merge readiness

✅ Ready for maintainer review

Keep open: main still uses floating Node 24 selectors, and this focused security update has no identified patch defects.

Priority: P2
Reviewed head: 5f51a4cf032af9cf8df45b8e623ef498fe63c2ef

Before merge

None.

Findings

None.

Agent review details

How this fits together

GitHub Actions selects Node before running vocabulary maintenance, validation, publication, and Cloudflare deployment commands.

flowchart LR
  A[GitHub events] --> B[Select Node 24.22.1]
  B --> C[Discover and generate vocabulary]
  C --> D[Validate source and artifacts]
  D --> E[Publish checked vocabulary]
  E --> F[Deploy Cloudflare Worker]

Loading

Technical review

Best possible solution:

Retain this minimal runtime pin while preserving the existing workflow owners and deployment boundaries.

Do we have a high-confidence way to reproduce the issue?

Source confirms floating selectors on main, and the official Node release contains incident-key rejection; no vulnerable handshake was reproduced during this read-only review.

Is this the best way to solve the issue?

Updating the five existing selectors is the smallest complete repository change and keeps the documented Node 24 baseline.

AGENTS.md: not found in the target repository.

Codex review notes: model internal, reasoning medium; reviewed against 2a4aa0358923.

Provenance checked

• Node 24 workflow baseline and production job separation keeps the original intent (133ff85: Automate stable-release vocabulary maintenance through separated, constrained jobs; earlier tooling work explicitly retained Node 24. The original introduction of the inherited Node 24 selector is unknown at the local history boundary.)

Testing

Proof path: none.

Security

None.

Evidence

What I checked:

• Exact introduced change: The pinned introduction diff changes only five node-version values from 24 to 24.22.1; permissions, commands, artifacts, and deployment conditions remain intact. (.github/workflows/deploy.yml:38, 5f51a4cf032a)
• Current main still needs the change: The current default branch remains at the supplied base and contains five floating Node 24 selections. (.github/workflows/deploy.yml:38, 2a4aa0358923)
• Official security release: The official v24.22.1 release includes rejection of certificate chains containing blocked public keys: https://github.com/nodejs/node/releases/tag/v24.22.1. The selected Node runtime directly supplies TLS behavior to workflow commands. (ce7aaf1cee78)
• Incident rejection implementation: The release-listed TLS commit adds eight compromised-intermediate SPKI hashes and checks certificate chains through the normal verification callback. (src/crypto/crypto_context.cc, 01acf0ee7493)
• Existing workflow intent: feat(telemetry): maintain public vocabulary from stable releases #29 established the separated generation, validation, publication, and deployment jobs; chore: refresh worker tooling and validate pull requests #5 explicitly preserved Node 24 and restricted production deployment. (.github/workflows/deploy.yml:22, 133ff8562f72)
• Exact-head validation and inspection limit: The exact-head workflow check and CodeQL checks succeeded; production jobs were skipped. Downloading the check-job logs was blocked at GitHub's redirected Azure storage host, so their contents were not inspected. (.github/workflows/deploy.yml:94, 5f51a4cf032a)

Likely related people:

• Peter Steinberger: Raw commit ef6a8e6 adds .github/workflows/deploy.yml:18 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: ef6a8e6943c7; files: .github/workflows/deploy.yml)

Labels

Label changes:

• add P2: A narrowly scoped CI security-runtime update with no demonstrated outage or active exploitation in this repository.
• add rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦐 gold shrimp and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.

Label justifications:

• P2: A narrowly scoped CI security-runtime update with no demonstrated outage or active exploitation in this repository.
• rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦐 gold shrimp and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only. Repair and merge execution lanes are retired.

Reviewed October 21, 2026, 6:33 PM ET / 22:33 UTC.