chore: Bump node & actions

.github/actions/js-setup/action.yml

@@ -0,0 +1,56 @@
+name: "Setup JS"
+description: "Install JS toolchain and dependencies (node_modules)"
+
+runs:
+  using: "composite"
+
+  steps:
+    # https://github.com/actions/setup-node
+    - name: Install Node.js
+      uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+      with:
+        node-version-file: ".nvmrc"
+        package-manager-cache: false
+
+    - name: Install pnpm
+      uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
+      with:
+        cache: true
+
+    - name: Debug versions
+      shell: bash
+      run: |
+        node -v
+        npm -v
+        pnpm -v
+
+    - name: Audit dependencies (before installing anything)
+      # Ignore "low" and "moderate" advisories for now.
+      run: pnpm audit --audit-level high
+      shell: bash
+
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+      shell: bash
+
+    - name: Check provenance attestations
+      run: pnpm audit signatures
+      shell: bash
+
+    # We build architecture specific caches for turbo builds as there can be differences in the build artifacts between architectures
+    - name: Setup turbo build cache
+      uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+      with:
+        path: .turbo/cache
+        key: ${{ runner.os }}-${{ runner.arch }}-turbo-${{ github.head_ref || github.ref_name }}-${{ github.sha }}
+        # The hierarchy of restoring the cache goes as follows:
+        #
+        # - First we try to match an existing cache from the same branch
+        # - Then we try to match a cache from the target branch of this PR (if this is not a PR, this cache will never exist)
+        # - Then we try to match a cache from the default branch
+        # - Then we try to match any cache
+        restore-keys: |
+          ${{ runner.os }}-${{ runner.arch }}-turbo-${{ github.head_ref || github.ref_name }}-
+          ${{ runner.os }}-${{ runner.arch }}-turbo-${{ github.base_ref }}-
+          ${{ runner.os }}-${{ runner.arch }}-turbo-${{ github.event.repository.default_branch }}-
+          ${{ runner.os }}-${{ runner.arch }}-turbo-

.github/workflows/ci.yml

@@ -25,12 +25,14 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b # v3.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
+      # https://github.com/actions/setup-node
       - name: Install Node.js
-        uses: actions/setup-node@8c91899e586c5b171469028077307d293428b516 # v3.5.1
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
-          node-version: 20
+          node-version-file: ".nvmrc"
+          package-manager-cache: false
 
       # Some frames (like import/export-and-sign) depend on code in ./shared.
       # Ensure shared's dependencies (including bech32) are installed before running their tests.
@@ -69,12 +71,14 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b # v3.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
+      # https://github.com/actions/setup-node
       - name: Install Node.js
-        uses: actions/setup-node@8c91899e586c5b171469028077307d293428b516 # v3.5.1
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
-          node-version: 20
+          node-version-file: ".nvmrc"
+          package-manager-cache: false
 
       - name: Install Dependencies for ${{ matrix.directory }}
         working-directory: ./${{ matrix.directory }}
@@ -102,12 +106,14 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b # v3.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
+      # https://github.com/actions/setup-node
       - name: Install Node.js
-        uses: actions/setup-node@8c91899e586c5b171469028077307d293428b516 # v3.5.1
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
-          node-version: 20
+          node-version-file: ".nvmrc"
+          package-manager-cache: false
 
       - name: Install Dependencies for ${{ matrix.directory }}
         working-directory: ./${{ matrix.directory }}
@@ -130,12 +136,14 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b # v3.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
+      # https://github.com/actions/setup-node
       - name: Install Node.js
-        uses: actions/setup-node@8c91899e586c5b171469028077307d293428b516 # v3.5.1
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
-          node-version: 20
+          node-version-file: ".nvmrc"
+          package-manager-cache: false
 
       - name: Install Dependencies for shared
         working-directory: ./shared

.github/workflows/publish-container.yml

@@ -19,12 +19,12 @@ jobs:
       packages: write
     steps:
       - name: Checkout
-        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           ref: ${{ github.event.pull_request.head.sha }}
       - name: Docker meta
         id: meta
-        uses: docker/metadata-action@96383f45573cb7f253c731d3b3ab81c87ef81934 # v5.0.0
+        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
         with:
           images: |
             ghcr.io/tkhq/frames
@@ -37,16 +37,16 @@ jobs:
         run: |
           echo "committer_date=$(git log -1 --pretty=%ct)" >> "$GITHUB_ENV"
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@f95db51fddba0c2d1ec667646a06c2ce06100226 # v3.0.0
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
       - name: Login to GHCR
         if: github.event_name != 'pull_request'
-        uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3.0.0
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
       - name: Build and push
-        uses: docker/build-push-action@0565240e2d4ab88bba5387d719585280857ece09 # v5.0.0
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         with:
           context: .
           platforms: linux/amd64,linux/arm64

.nvmrc

@@ -1 +1 @@
-18.18.2
+v24.11.0

Dockerfile

@@ -1,5 +1,7 @@
+ARG NODE_VERSION=24.11.0
+
 # Multi-stage build: first stage for building webpack bundles
-FROM node:18-bullseye-slim AS builder
+FROM node:${NODE_VERSION}-bullseye-slim AS builder
 
 WORKDIR /app
 
@@ -20,8 +22,8 @@
 # https://hub.docker.com/layers/nginxinc/nginx-unprivileged/1.24.0-bullseye/images/sha256-a8ec652916ce1e7ab2ab624fe59bb8dfc16a018fd489c6fb979fe35c5dd3ec50
 FROM docker.io/nginxinc/nginx-unprivileged:1.24.0-bullseye@sha256:ac0654a834233f7cc95b3a61550a07636299ce9020b5a11a04890b77b6917dc4
 
 LABEL org.opencontainers.image.title frames
 LABEL org.opencontainers.image.source https://github.com/tkhq/frames
 
 COPY nginx.conf /etc/nginx/nginx.conf