[TueJon]

Pin CI to Node 22.23.5 so setup-node cannot select an older cached Node 22 version after the November security release. Runtime code and existing runner isolation checks are unchanged.

Validation: checksum-verified Node 22.23.5, npm ci (audit 0), npm run check (79 tests pass), independent review.

[TueJon]

Review — Pin CI to the patched Node 22 security release

First review at this head (6147865). One-line CI pin, no prior reviews. CI check job is green at this head; ai-review is this run.

What I checked

• Diff is exactly one line in .github/workflows/ci.yml: node-version: 22 → 22.23.5. Runner labels, isolation-verification step, fork guards (head.repo.full_name check), and permissions: contents: read are all untouched.
• Repo rules (AGENTS.md): this repo is an agent skill; its hard rules concern SKILL.md token-efficiency, runtime dependency-freedom, TS/JS sync, and version-manifest sync. A CI-only Node pin touches none of that surface.

Findings

None. No blocking and no non-blocking findings:

• Product fit: pinning CI to a patched security release so a self-hosted runner with a stale cached Node 22 cannot silently test against a vulnerable runtime is a legitimate, minimal hardening step.
• Correctness: exact pin resolves (proven by the green check run at this head, which itself runs setup-node → npm ci → npm run check). Trade-off is known and accepted: future Node security fixes need another one-line bump rather than floating forward automatically.
• Security / external effects / migration / docs: no secrets, no new runners or permissions, no schema or runtime-code change, no docs invalidated, no release-steps/-style follow-up needed.

Verdict

Clean one-line security pin, CI green at this head. Nothing further required.