From 660ccd922307213e32ed8b6ac6228e7fcc6db032 Mon Sep 17 00:00:00 2001
From: alexander-akait <4567934+alexander-akait@users.noreply.github.com>
Date: Mon, 14 Sep 2026 13:13:15 +0000
Subject: [PATCH] ci: test on Node 26, pin every action, fold the checks job in
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Node 26 joins 22 and 24 across the three platforms.

Every action is pinned to the commit its tag names, with the version as a
comment, the way `less-loader` does it — each one read back from the tag
before it was written down.

The `test-checks` job is gone. Of its four combinations only one covered
anything: `npm ci` installs eslint 10.10.0 and stylelint 17.15.0 already,
which is what `eslint@10.x` and `stylelint@17.x` resolve to. The one that
did — the oldest ESLint the peer range names — is a matrix entry now, so
it runs the same command as every other test job. Its version is part of
the concurrency group as well, or it would cancel the run it shares a
platform and a Node version with.
---
 .github/workflows/dependency-review.yml |  9 ++--
 .github/workflows/nodejs.yml            | 66 +++++++++----------------
 2 files changed, 28 insertions(+), 47 deletions(-)

diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml
index ee0524fd..39ce8244 100644
--- a/.github/workflows/dependency-review.yml
+++ b/.github/workflows/dependency-review.yml
@@ -8,7 +8,8 @@ jobs:
   dependency-review:
     runs-on: ubuntu-latest
     steps:
-      - name: "Checkout Repository"
-        uses: actions/checkout@v6
-      - name: "Dependency Review"
-        uses: actions/dependency-review-action@v4
+      - name: Checkout Repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Dependency Review
+        uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0
diff --git a/.github/workflows/nodejs.yml b/.github/workflows/nodejs.yml
index 7f9f7006..8093cfc4 100644
--- a/.github/workflows/nodejs.yml
+++ b/.github/workflows/nodejs.yml
@@ -32,14 +32,16 @@ jobs:
       cancel-in-progress: true
 
     steps:
-      - uses: actions/checkout@v6
+      - name: Checkout Repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
 
       - name: Use Node.js ${{ matrix.node-version }}
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: ${{ matrix.node-version }}
+          cache: "npm"
 
       - name: Install dependencies
         run: npm ci
@@ -51,25 +53,34 @@ jobs:
         run: npm run security
 
   test:
-    name: Test - ${{ matrix.os }} - Node v${{ matrix.node-version }}, Webpack ${{ matrix.webpack-version }}
+    name: Test - ${{ matrix.os }} - Node v${{ matrix.node-version }}, Webpack ${{ matrix.webpack-version }}, ESLint ${{ matrix.eslint-version }}
 
     strategy:
       matrix:
         os: [ubuntu-latest, windows-latest, macos-latest]
-        node-version: [22.x, 24.x]
+        node-version: [22.x, 24.x, 26.x]
         webpack-version: [latest]
+        eslint-version: [latest]
+        include:
+          # The oldest ESLint the peer range names, which the checks are never
+          # run against otherwise: what `npm ci` installs is the newest.
+          - os: ubuntu-latest
+            node-version: 22.x
+            webpack-version: latest
+            eslint-version: 9.x
 
     runs-on: ${{ matrix.os }}
 
     concurrency:
-      group: test-${{ matrix.os }}-v${{ matrix.node-version }}-${{ matrix.webpack-version }}-${{ github.ref }}
+      group: test-${{ matrix.os }}-v${{ matrix.node-version }}-${{ matrix.webpack-version }}-eslint-${{ matrix.eslint-version }}-${{ github.ref }}
       cancel-in-progress: true
 
     steps:
-      - uses: actions/checkout@v6
+      - name: Checkout Repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Use Node.js ${{ matrix.node-version }}
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: ${{ matrix.node-version }}
           cache: "npm"
@@ -80,46 +91,15 @@ jobs:
       - name: Install webpack ${{ matrix.webpack-version }}
         run: npm i webpack@${{ matrix.webpack-version }}
 
+      - name: Install ESLint ${{ matrix.eslint-version }}
+        if: matrix.eslint-version != 'latest'
+        run: npm i eslint@${{ matrix.eslint-version }}
+
       - name: Run tests for webpack version ${{ matrix.webpack-version }}
         run: npm run test:coverage
 
       - name: Submit coverage data to codecov
-        uses: codecov/codecov-action@v6
+        uses: codecov/codecov-action@57e3a136b779b570ffcdbf80b3bdc90e7fab3de2 # v6.0.0
         with:
           files: ./lcov.info
           token: ${{ secrets.CODECOV_TOKEN }}
-
-  test-checks:
-    name: Test - checks - Eslint ${{ matrix.eslint-version }}, Stylelint ${{ matrix.stylelint-version }}
-
-    strategy:
-      matrix:
-        eslint-version: [9.x, 10.x]
-        stylelint-version: [17.x]
-
-    runs-on: ubuntu-latest
-
-    concurrency:
-      group: test-checks-${{ matrix.eslint-version }}-${{ matrix.stylelint-version }}-${{ github.ref }}
-      cancel-in-progress: true
-
-    steps:
-      - uses: actions/checkout@v6
-
-      - name: Use Node.js lts/*
-        uses: actions/setup-node@v6
-        with:
-          node-version: lts/*
-          cache: "npm"
-
-      - name: Install dependencies
-        run: npm ci
-
-      - name: Install eslint ${{ matrix.eslint-version }}
-        run: npm i eslint@${{ matrix.eslint-version }}
-
-      - name: Install stylelint ${{ matrix.stylelint-version }}
-        run: npm i stylelint@${{ matrix.stylelint-version }}
-
-      - name: Run tests
-        run: npm run test:only