[joshavant]

What Problem This Solves

Managed CI, hydration and release jobs can select cached Node versions that trust the compromised eMudhra keys.

User Impact

Pin Node 22.23.4, 24.22.1 and 26.12.1 within the existing release lines. Installed products and the Actions runner require separate updates.

Why This Change Was Made

Exact fixed patches prevent old cache entries from satisfying setup-node, including its fallback after manifest-resolution failure.

Evidence

On Linux arm64: typecheck, lint, build and tests passed (976 passed, two skipped). Independent review and git diff --check passed. Official Linux arm64 release binaries rejected all 12 incident chains in eight trust modes, with ordinary HTTPS controls passing. Other platform executions remain hosted CI proof.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs maintainer review before merge.

What this changes

This PR pins CI, hydration, and release jobs to Node 22.23.4, 24.22.1, and 26.12.1.

Example: A runner has Node 24.22.0 cached when a release job starts.

• Before: The Node 24 selector can accept the older cached runtime.
• After: The job requires Node 24.22.1.

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A minimal, useful security maintenance patch supported by the official release advisory and successful reviewed-head checks.
Proof confidence	🌊 off-meta tidepool	Not applicable: The supplied maintainer-authored classification exempts ordinary contributor proof; the body reports Linux arm64 incident-chain rejection, and reviewed-head CI supplies supporting validation without independently inspectable certificate traces.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Product

Kind: Maintenance · Worth it: Yes · Fix scope: Complete
User problem: Managed jobs can run cached Node releases that retain trust affected by the eMudhra incident.
Reason: The supplied maintainer-authored classification establishes direction, and the official advisory supports the narrowly scoped security update.

Merge readiness

✅ Ready for maintainer review

Keep this PR open: main still uses broad Node selectors, and the focused security update preserves runtime coverage without an identified patch defect.

Priority: P1
Reviewed head: 791ff98c0ea1f27cd47920b348a2df32613764a3

Before merge

None.

Findings

None.

Agent review details

How this fits together

GitHub Actions selects Node before dependency installation, validation, workspace hydration, and package publishing.

flowchart TD
  A[Workflow trigger] --> B[Exact Node selector]
  B --> C[setup node cache or download]
  C --> D[Patched Node runtime]
  D --> E[Install and validate]
  E --> F[Hydrate or publish]

Loading

Technical review

Best possible solution:

Land the focused runtime pins while retaining the existing supported release lines and workflow permissions.

Do we have a high-confidence way to reproduce the issue?

Main’s major-version selectors and the pinned setup-node implementation establish the older-cache selection path; no target code was executed during this review.

Is this the best way to solve the issue?

Exact patch selectors are the smallest complete change for the stated managed-job boundary and preserve the existing runtime matrix.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 8cf3053c5e14.

Provenance checked

• Node selection in CI, hydration, and release workflows changes intended behavior with a stated reason (88ba04e; 02b0915; b979f94; 857d854; 637d2bd: Earlier changes established CI, Windows executor coverage, supported-runtime testing, constrained hydration, and release automation using major-version selectors.)

Testing

Proof path: unit tests only.

Security

None.

Evidence

What I checked:

• Verified introduced change: The pinned base-to-head diff contains only five Node selector substitutions across three workflows; main retains the broad selectors. (.github/workflows/ci.yml:25, 791ff98c0ea1)
• Cache and fallback contract: The workflows execute this pinned action; its implementation passes versionSpec to cache lookup, manifest resolution, and direct-download version matching, supporting the exact-pin rationale. (src/distributions/official_builds/official_builds.ts, 949feb2413d6)
• Official security release confirmation: Node’s official advisory identifies the eMudhra certificate update and lists all three selected releases.
• Reviewed-head validation: The completed CI run targets the reviewed head and reports successful Linux tests, Node 22.23.4 and 24.22.1 compatibility jobs, and Windows executor checks; hosted log downloads were blocked by the network allowlist. (.github/workflows/ci.yml, 791ff98c0ea1)
• Existing runtime contract and ownership: The earlier runtime coverage PR established Node 22, 24, and 26 coverage, which this PR preserves; CODEOWNERS routes workflow changes to openclaw/openclaw-secops. (.github/CODEOWNERS:13, 8cf3053c5e14)

Likely related people:

• Peter Steinberger: Raw commit b979f94 adds .github/workflows/ci.yml:49 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: b979f94701be; files: .github/workflows/ci.yml)
• Vincent Koc: Raw commit 857d854 adds .github/workflows/crabbox-hydrate.yml:30 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: 857d854ac8d0; files: .github/workflows/crabbox-hydrate.yml)

Labels

Label changes:

• add P1: The change prevents managed automation from selecting older runtimes affected by an officially confirmed certificate security incident.
• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.

Label justifications:

• P1: The change prevents managed automation from selecting older runtimes affected by an officially confirmed certificate security incident.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only. Repair and merge execution lanes are retired.

Reviewed October 21, 2026, 5:43 PM ET / 21:43 UTC.