Repository navigation
CI installs Node once per job, from setup-node - #1397
Merged
Merged
Conversation
package.json's devEngines.runtime (onFail: download) puts a node@runtime dependency in the lockfile, so every `pnpm install` fetched Node from nodejs.org again after setup-node had already put the same pinned version on PATH. On 2026-10-28 that fetch timed out and failed Library Tests, hung Standalone Smoketest, and stalled the macOS platform check. PR workflows (ci.yml, argos.yml, hosted-preview.yml, security-audit.yaml) now install with `--no-runtime` and run on setup-node's binary, which setup-node takes from the runner's tool cache or the actions/node-versions releases on GitHub rather than nodejs.org. Build & Test is the one exception: its self-host installer step runs a plain `pnpm install` that provisions the runtime regardless, so that job drops setup-node and puts pnpm's runtime on PATH instead, after checking it matches the pin. The version still comes from devEngines.runtime alone. Release, publish, and production-deploy workflows are unchanged. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
`build.rs` bundles the `node` on PATH, which under `pnpm tauri` is the devEngines.runtime install, checked against the lockfile's sha256. Copying CI's new `--no-runtime` into release.yml's build-standalone would swap in setup-node's binary and still pass the version check. S278 makes that a FAIL IF, pinned by scripts/supply-chain-config.test.mjs. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Deploying mouseterm with
|
| Latest commit: |
7e98cac
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://b1628052.mouseterm.pages.dev |
| Branch Preview URL: | https://ci-single-node-download.mouseterm.pages.dev |
dormouse-bot
approved these changes
Oct 28, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
devEngines.runtimeusesonFail: "download", so the lockfile carriesnode@runtime:24.22.1. Everypnpm installtherefore fetched Node from nodejs.org again, even when setup-node had already installed the same pinned version. On 2026-10-28, between 07:10 and 07:30 UTC, that fetch timed out: it failed Library Tests, hung the Standalone Smoketest for 30 minutes, and stalled the macOS platform check.pnpm install --frozen-lockfile --no-runtimeand use setup-node's binary. That binary comes from the runner's tool cache or GitHub'sactions/node-versions, with nodejs.org only as a last resort. The version still comes only fromdevEngines.runtime, throughnode-version-file: package.json.pnpm install, which provisions the runtime anyway. So this job drops setup-node instead, takes pnpm's runtime, checks it against the pin, and puts it onGITHUB_PATH. That is one download, still from nodejs.org.build.rsbundles thenodeon PATH, and underpnpm taurithat is pnpm's lockfile-checked runtime. The new FAIL IFS278(security-supply-chain.md, pinned byscripts/supply-chain-config.test.mjs) fails ifrelease.yml'sbuild-standaloneever passes--no-runtime, which would make it ship a different binary.Caching the pnpm store was considered and rejected: it would compete with rust-cache for the 10 GB cache quota.
The Windows and macOS runners first exercise this in this PR's own CI.
🤖 Generated with Claude Code