Repository navigation
Conversation
Update checkout and setup-node, whose Node.js 12/16 runtimes no longer run on GitHub Actions. Move development and the lint job to Node.js 24 LTS, as Node.js 20 reached end of life. Keep the lint job name, it is the required check on main.
codeql-action v3 is deprecated. Drop the template comments and the unused manual build step. The job name stays the same.
Pass the tag to scripts through env instead of interpolating it in the script body, like the other steps already do.
|
Important Review skippedReview was skipped as selected files did not have any reviewable changes. ⛔ Files ignored due to path filters (1)
⚙️ Run configuration
⛔ Files ignored due to path filters (1)
You can disable this status message by setting the Use the checkbox below for a quick retry:
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configuration
⛔ Files ignored due to path filters (1)
📒 Files selected for processing (6)
Included review availability: This review used your included allowance. Your plan provides up to 2 included reviews per hour; 1 remain after this review. 📝 WalkthroughWalkthroughThe package now requires Node.js 22 or newer. The test workflow adds Node.js and Nodemailer compatibility checks. The CodeQL and draft-release workflows update action versions and workflow settings. ChangesNode.js support and compatibility
GitHub workflow updates
Priority: ➖ Normal Estimated code review effort: 3 (Moderate) | ~25 minutes Change: Other Merge Risk: ⚪ Minimal · up to No actionable issue remains from this review; the change is mergeable after normal checks. Security Architecture ReviewSecurity architecture risk: 🔵 Low · up to The inspected changes narrow validation-job credentials and preserve release automation’s existing authority and sequencing. No introduced or worsened security concern was established. Risk remains low rather than minimal because the upgraded actions’ credential and failure behavior has not been independently verified. Retained concerns Security review detailsSecurity Blast Radius
Trust Boundaries and Controls
Resilience and Maintainability Implications
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
There was a problem hiding this comment.
Copilot review overview
🔵 Needs a closer look
It changes multiple CI workflows and the supported Node baseline, which needs a real GitHub Actions run/maintainer validation beyond static review.
Review effort: Lite
Findings: 1
Open (1)
What changed in this PR
This PR updates the repository’s supported Node.js baseline and modernizes GitHub Actions workflows to run CI across currently supported Node versions, including dedicated compatibility checks for Nodemailer 9 and 10.
Changes:
- Raise the package’s supported Node.js range (
engines.node) to>=22and update local toolchain to Node 24 via.tool-versions. - Modernize CI workflows (actions majors, permissions hardening, concurrency, timeouts) and add a Node.js version matrix job.
- Add Nodemailer-major CI jobs that validate both library source type-checking and consumer type-checking against the packed build.
| File | Description |
|---|---|
| README.md | Documents the new Node.js baseline and updates the Nodemailer transport note. |
| package.json | Raises engines.node to >=22. |
| .tool-versions | Updates the local Node.js toolchain version to 24.21.0. |
| .github/workflows/test.yml | Updates actions versions, adds concurrency/permissions/timeouts, adds Node matrix + Nodemailer compatibility jobs. |
| .github/workflows/draft-release.yml | Updates actions versions and hardens tag handling by passing values via env. |
| .github/workflows/codeql.yml | Updates CodeQL/action majors, adds concurrency, and simplifies the template. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Motivation
Follow-up to the CI discussion in #161: Node.js 20 is being removed from GitHub Actions runners,
codeql-actionv3 is deprecated, @izikaj asked for CI on Node.js 24, and @oshchyhol pointed out that CI tested neither the versionsenginespromises nor nodemailer 9. I said I'd add a nodemailer 9 job, so it's here.Changes
checkoutv2/v4 → v7,setup-nodev3/v4 → v7,github-scriptv7 → v9,codeql-actionv3 → v4. The old ones run on Node.js runtimes GitHub no longer supports. The breaking changes in these majors don't affect our workflows..tool-versionsgoes from 20.20.2 (EOL since April 2026) to 24.21.0. Thelintjob now reads it throughnode-version-file, like the release workflow already did.engines.noderaised to>=22, README updated. In Nodemailer 10 support #161 I argued for keeping>=16.20.1. I changed my mind: every version below 22 is end-of-life, and keeping it meant promising versions CI doesn't test.test (Node.js 22 / 24 / 26)jobs.nodemailer 9(with@types/nodemailer) andnodemailer 10. Each one type-checks the sources and runs the tests against that major, then type-checks a consumer project against the packed build, as CommonJS withoutesModuleInteropand as native ESM (nodenext). I checked that they fail on the commits before 0d42479 and 1a803cc, so they would have caught both type breaks found in Nodemailer 10 support #161.permissions: contents: read, superseded PR runs cancelled, job timeouts,persist-credentials: falsewhere nothing is pushed. The release workflow passes the tag throughenvinstead of interpolating it in scripts. I also removed the CodeQL template comments and the unused manual build step.The required check names don't change (
lint,Analyze (javascript-typescript)).Impacts
.tool-versions).How to test
lint,test (Node.js 22/24/26),nodemailer 9,nodemailer 10, CodeQLImages and GIFs
N/A
This is a proposal, not a final version. If some of these choices don't match what you want for the project (
engines, the matrix, the extra jobs…), tell me and I'll adjust.Summary by CodeRabbit