ci: modernize Node builds and add validation gates

[rarepops]

What does this PR do?

Closes #2108.

This draft implements the CI maintenance proposal while awaiting maintainer feedback on its scope. Node 22 is still supported; this is not a blanket action-runtime deprecation update.

• Centralize UI build, Windows UI guard, and npm publishing runtimes on Node 24 through .node-version.
• Run the existing frontend tests and production build on Node 22 and 24 through one shared local/CI entry point.
• Expand the existing package-wrapper matrix to Node 22 and 24 without changing the public runtime minimum.
• Pin all three Noble-specific LLVM lint/diagnostics jobs to Ubuntu 24.04.
• Replace deprecated actions/attest-sbom with the exact actions/attest implementation it already delegates to, preserving SBOM inputs, defaults, and NODE_OPTIONS.
• Add actionlint 1.7.12, with a verified release checksum, to the reusable lint workflow. Keep ShellCheck and Pyflakes outside this focused check.
• Schedule weekly graph-ui npm updates, grouping minor/patch updates and keeping major upgrades separate.
• Extend the venue-parity contract and document the shared local validation commands.

Existing C/sanitizer coverage, SHA-pinning policy, token permissions, release gate ordering, and supported platforms remain intact. No application dependency versions are changed.

Validation

Passed locally on Windows:

• actionlint 1.7.12 across all 22 workflows.
• Frontend on Node 22: 47 tests passed and production build passed.
• Frontend on Node 24: 47 tests passed and production build passed.
• npm wrapper on Node 22 and 24: 10 tests passed on each runtime.
• tests/test_venue_parity_contract.sh, including 20 help entries and 10 strict-argument probes.
• tests/test_release_gate_chain_contract.sh.
• tests/test_shell_line_endings.sh.
• SBOM compatibility check: same delegate SHA, artifact inputs, environment, input defaults, and permissions.
• Structured runner check: all three jobs using apt.llvm.org/noble run on ubuntu-24.04.
• git diff --check.

Not run locally: the full C test suite, C lint, Go/PyPI wrapper suites, and hosted cross-platform/release jobs. The existing hosted gates remain enabled; maintainer approval to run fork CI may be required. The frontend build still reports its existing bundle-size warning.

Broader CI audit (2026-09-08)

The follow-up in 840de91 is based on workflow annotations and action metadata, not just action version labels:

• Parsed all 22 checked-in workflows at e65fffc and resolved 25 distinct action entry points plus their composite dependencies (28 action manifests in total). None declared Node 12, 16, or 20. This result does not cover GitHub-owned generated workflows.
• Inspected 155 checks from the latest completed run of each of 22 standalone/generated workflow histories. Some histories are months old, so their warnings were distinguished from current configuration problems.
• The release SBOM job explicitly warns that actions/attest-sbom is deprecated. The unchanged wrapper pin in current source emitted the same warning; it is now replaced by its exact delegate.
• The diagnostics job had the same moving-runner/Noble-repository mismatch as the lint jobs. All three jobs are now pinned consistently.
• Maintainer setting required: this generated Pages run loads upload-pages-artifact@v3 -> upload-artifact@v4 (Node 20). The Pages API reported build_type: legacy, source main:/docs. The checked-in Pages workflow already uses upload-pages-artifact v5 with a Node 24 uploader. Select Settings > Pages > Build and deployment > Source > GitHub Actions, then run Deploy Pages. This PR does not change live repository settings and cannot eliminate that generated-run warning by changing setup-node.
• The sampled June fablize-ci PR run also had old checkout/setup-python warnings, but that workflow is absent from this current checkout. CodeQL's manual-mode overlay fallback and Homebrew's tap-trust advisory are left unchanged; this patch does not weaken C extraction or tap trust to suppress warnings.

The follow-up passes actionlint and the venue-parity/release-gate contracts. Actual hosted SBOM attestation remains a release-only check and was not triggered locally.

Checklist

• Every commit is signed off (git commit -s).
• Tests pass locally (make -f Makefile.cbm test): full C suite not run; focused checks are listed above.
• Lint passes (make -f Makefile.cbm lint-ci): C lint not run; workflow lint passes.
• New behavior is covered by a test: existing frontend tests are now gating and the new shared entries are protected by the venue-parity contract.

[github-actions]

Thanks for opening this — it has been seen, and it is queued.

This note is automated, but it is not a brush-off: it exists so you know where your PR stands instead of having to guess from silence.

Current review status: working through a backlog. 0.9.1-rc.1 is out, so the release freeze that held reviews is over — but it left a large queue of open pull requests behind it, and we are reading through them oldest-first. The background is in discussion #1144.

What that means for this PR, concretely:

• It will not be closed for inactivity. No stale bot touches pull requests here.
• It may still sit a while before a human reads it. That is on us, not on you.
• Older PRs are read first, so a recent one is not being skipped — it is behind a queue.

Things that will genuinely speed it up whenever review does happen:

• Keep it rebased on main — the tree is moving quickly right now, and a conflicting branch cannot be reviewed as the diff you intended.
• Get CI green, or say which failures you believe are pre-existing.
• Keep the change to one claim. Bundled features and refactors get split before they get merged, which costs you a round trip.
• Every commit needs a sign-off (git commit -s) — CI enforces DCO.

If this fixes a bug, a reproduction we can run is worth more than a description of the symptom.

Thanks for contributing, and sorry in advance for the wait.

[rarepops]

CI run 34255410324: Windows daemon guard recurrence

Run at 840de91 completed with one primary failed job: test / test-windows-guards. The ci-ok failure is the expected downstream propagation.

Passing hosted checks include both frontend Node 22/24 jobs, all four package-wrapper matrix jobs, all three lint jobs, security gates, Unix/Windows C shards, sanitizer lanes (diagnostics/MSan/LSan/TSan), and shard completeness. Seven of the eight native Windows guard scripts also passed.

The failures are both in tests/windows/test_daemon_stability.py:

• section_start_status_port: daemon start on an occupied UI port reports daemon.client.rendezvous_wait / daemon.client.connect_deadline with status=absent, then "the daemon did not accept the UI configuration; browser was not opened".
• section_cold_storm: client 1 exits with "secure CLI coordination could not be created (endpoint)". This is a completed client returning an error, not the harness's missing-result timeout path.

These symptoms match the pre-existing reports in #2057. I also checked the independent September 6 job directly: it prints the identical cold-storm endpoint refusal for client 2. Comparing upstream base 161df2b with this head confirms src/, internal/, tests/windows/, and scripts/test-windows.ps1 are unchanged by this PR.

The current stability guard already sets a per-section CBM_RUNTIME_DIR, so the older issue description alone is not enough to establish the remaining cause. This report records the recurrence; it does not claim a proven timeout or isolation fix. No retries, timeout increases, skips, or weakened assertions have been added. The root cause remains tracked separately in #2057.

[DeusData]

Thank you for contributing the Node and validation updates, and for documenting the Windows-guard recurrence without weakening the guard. This touches build, test and release workflows as well as contributor guidance, so we need more time to review the scope and release implications before giving a decision.

The review queue is currently full, so detailed feedback may take a little time. We are working through it carefully and appreciate the work you have put into supporting the project. Thank you for your patience.