René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"meta: notify-on-push workflow uses old core-validate-commit@5.0.1","articleBody":"## Situation\n\nnotify-on-push workflow uses the older `core-validate-commit@5.0.1` release instead of `6.0.0` causing some merge commits to be incorrectly flagged, notably all `ffi` commits.\n\n## Background\n\nWorkflow [.github/workflows/notify-on-push.yml](https://github.com/nodejs/node/blob/main/.github/workflows/notify-on-push.yml) job `validateCommitMessage` specifies `runs-on: ubuntu-24.04-arm`.\n\nThe GitHub partner runner image inventory for [ubuntu-24.04-arm](https://github.com/actions/partner-runner-images/blob/main/images/Ubuntu2404-Readme.md#language-and-runtime) shows a default installed Node.js 20.20.0.\n\nSince there is no step in the workflow to install any alternate Node.js version, the job runs in Node.js 20.20.0 (with bundled npm 10.8.2).\n\nThe job `validateCommitMessage` executes:\n\n```shell\nrun: echo \"$COMMITS\" | npx -q core-validate-commit -\n```\n\nhttps://github.com/npm/cli/issues/7704 describes how npm 10.8.2 changed behavior, which is now documented for npm 11.11.1 under\n\n`npm install [\u003c@scope\u003e/]\u003cname\u003e`:\n\n\u003e Note: When installing by name without specifying a version or tag, npm prioritizes versions that match the current Node.js version based on the package's engines field. If the latest tag points to a version incompatible with your current Node.js version, npm will install the newest compatible version instead. To install a specific version regardless of engines compatibility, explicitly specify the version or tag: npm install \u003cname\u003e@latest.\n\n(This documentation addition has not been backported to the npm 10.x documentation, nor referenced in the [npx 10](https://docs.npmjs.com/cli/v10/commands/npx) / [npx 11](https://docs.npmjs.com/cli/v11/commands/npx) documentation.)\n\nThe npm package [core-validate-commit](https://www.npmjs.com/package/core-validate-commit) has the following engines minimum definitions:\n\n| core-validate-commit                                                        | released     | engines minimum   |\n| --------------------------------------------------------------------------- | ------------ | ----------------- |\n| [6.0.0](https://github.com/nodejs/core-validate-commit/releases/tag/v6.0.0) | Apr 27, 2026 | \"node\": \"^22.21.1 |\n| [5.0.1](https://github.com/nodejs/core-validate-commit/releases/tag/v5.0.1) | Mar 18, 2026 | \"node\": \"^20.19.6 |\n\nnpx therefore installs the older `core-validate-commit@5.0.1` since it is the highest version that satisfies the engines conditions for Node.js 20.20.0.\n\nThe consequence is that the enhancements / fixes for [6.0.0](https://github.com/nodejs/core-validate-commit/releases/tag/v6.0.0) are not available:\n\n- add Signed-off-by and Assisted-By rules\n- parse trailers using git if available, allow longer lines\n- rules: add ffi subsystem\n- rules: add line-length exemptions for DCO sign-offs\n\nThis is particularly noticeable for every `ffi` PR merged into main, that then triggers a slack notification\n\n\u003e ✖  0:0      Invalid subsystem: \"ffi\"                  subsystem\n\n## Suggestion\n\nIn the workflow [.github/workflows/notify-on-push.yml](https://github.com/nodejs/node/blob/main/.github/workflows/notify-on-push.yml) job `validateCommitMessage` add the following step, as commonly used in other GitHub Actions workflows:\n\n```shell\n      - name: Use Node.js ${{ env.NODE_VERSION }}\n        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0\n        with:\n          node-version: ${{ env.NODE_VERSION }}\n```\n\nI can't test this in a fork, so I defer to core Collaborators to review and make this change.\n\ncc: @nodejs/actions\ncc: @ShogunPanda ","author":{"url":"https://github.com/MikeMcC399","@type":"Person","name":"MikeMcC399"},"datePublished":"2026-05-01T17:30:40.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":6},"url":"https://github.com/63070/node/issues/63070"}