refactor(ci): improve workflows with centralized node version and github actions pinned to latest release versions

[mahula]

Motivation

In the Github workflows

• the Noe.js version was set hardcoded
• the Github Actions were pinned to older release versions

Changes

• Centralize Node version: Use .nvmrc file; all workflows now reference it via node-version-file instead of hardcoding
• Pin GitHub Actions: Actions are now pinned to their latest versions.

Impact

• Single source of truth for Node version, environment can use nvm use to set and use the exact Node.Js version configured in this repository
• Increased security with used Github Actions

[DavidMStraub]

Thanks for trying to improve CI, but

The test workflow ran all checks serially (linting → type check → test → build).
This creates dependencies on the success of earlier run checks and results in early failure in this pipeline blocking useful information from checks run after.

This is 100% intentional.

Linting is near instant, type checking is super fast, test is terribly slow. If a PR fails the first two steps, I don't wanna wait for the whole test suite to run!

Also, if a test fails (which normally shouldn't happen because devs should test their changes locally), I wan't CI to fail fast rather than complete the full test suite. This actually speeds up iterations when working on a feature.

I also find it strange that you pin workflow versions to a specific commit.

[mahula]

Thanks for trying to improve CI, but

The test workflow ran all checks serially (linting → type check → test → build).
This creates dependencies on the success of earlier run checks and results in early failure in this pipeline blocking useful information from checks run after.

This is 100% intentional.

Linting is near instant, type checking is super fast, test is terribly slow. If a PR fails the first two steps, I don't wanna wait for the whole test suite to run!

Also, if a test fails (which normally shouldn't happen because devs should test their changes locally), I wan't CI to fail fast rather than complete the full test suite. This actually speeds up iterations when working on a feature.

I understand the intention.
The check parallelization has been reverted.

[mahula]

I also find it strange that you pin workflow versions to a specific commit.

This may seem strange at first glance, given that version tags do exist. Recently, established distributed software development tools used by a large number of people have increasingly become targets of corruption by malware and other threats. These include widely used NPM packages and the most commonly used GitHub Actions (such as checkout and setup-node).
For this reason, among others, GitHub introduced support for SHA pinning of actions.
This article highlights the risks of mutable tags and securing GitHub Actions with SHA pinning.

[DavidMStraub]

Huh interesting, thanks!

[Copilot]

Pull request overview

Improves CI reliability and security by enforcing Vitest coverage thresholds, centralizing the Node.js version via .nvmrc, and pinning key GitHub Actions to commit SHAs.

Changes:

• Add Vitest coverage thresholds so CI fails on coverage regressions.
• Introduce .nvmrc and update workflows to use node-version-file.
• Pin actions/checkout and actions/setup-node to SHAs for supply-chain hardening.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
vitest.config.js	Enforces minimum coverage thresholds during vitest run --coverage.
.nvmrc	Defines the Node.js version consumed by CI workflows via node-version-file.
.github/workflows/test.yml	Uses .nvmrc, enables npm cache, and pins checkout/setup-node by SHA.
.github/workflows/release.yml	Uses .nvmrc and pins checkout/setup-node by SHA.
.github/workflows/image-release.yml	Uses .nvmrc and pins checkout/setup-node by SHA.
.github/workflows/image-devel.yml	Uses .nvmrc and pins checkout/setup-node by SHA.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[DavidMStraub]

Let's please remove the SHA pinning altogether. It's a maintenance burden to keep updating them manually which I don't want to have.

[mahula]

It's a maintenance burden to keep updating them manually which I don't want to have.

The Dependabot configuration is taking care of Github Action Updates. When the related Dependabot PRs are opened and the workflows ran successful, the actions are updatable.

[mahula]

The Github actions of all workflows are now pinned to the tags of their latest released versions.

[Copilot]

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated 1 comment.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.