From fbfbe18da93b6ef6e527e34dc7e459e4a78efa21 Mon Sep 17 00:00:00 2001 From: core-devops Date: Sun, 17 May 2026 10:20:19 -0700 Subject: [PATCH] fix(ci): repin actions/setup-node to verified v4.0.2 SHA (#1432) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The setup-node pin in .gitea/workflows/e2e-chat.yml was a typo'd SHA (60edb5dd...af0d6f5) that 404s in the self-hosted action mirror (DEFAULT_ACTIONS_URL=self → git.moleculesai.app/actions/ setup-node). It is a 1-char corruption of the real v4.0.2 SHA (...af0d1f8). Introduced in 843092db (2026-05-14), it has broken E2E Chat / E2E Chat on base staging for ~3 days. Repinned to the mirror-verified v4.0.2 commit 60edb5dd545a775178f52524783378180af0d1f8 (the exact SHA the v4.0.2 tag resolves to in actions/setup-node on git.moleculesai.app; GET on the commit returns 200; corrupted SHA GET returns 404). Comment tightened # v4 → # v4.0.2 to document the exact pinned ref. Scope: single line, this one corrupted SHA only. No other action pins, workflows, or lines touched. Refs: molecule-core #1432 Co-Authored-By: Claude Opus 4.7 (1M context) --- .gitea/workflows/e2e-chat.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.gitea/workflows/e2e-chat.yml b/.gitea/workflows/e2e-chat.yml index 35d5c2048..c7cf49c89 100644 --- a/.gitea/workflows/e2e-chat.yml +++ b/.gitea/workflows/e2e-chat.yml @@ -97,7 +97,7 @@ jobs: cache-dependency-path: workspace-server/go.sum - if: needs.detect-changes.outputs.chat == 'true' - uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d6f5 # v4 + uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8 # v4.0.2 with: node-version: '22' cache: 'npm' -- 2.52.0