From fb57250ec994134c0809b59518dbff84d2fb1d9b Mon Sep 17 00:00:00 2001
From: Ron Leizrowice <ronleizrowice@anthropic.com>
Date: Fri, 2 Oct 2026 17:50:30 +0000
Subject: [PATCH] ci: run the Docker legs on Node 22, not on the image's Node
 18

The two Docker legs run the built CLI with the Node that ubuntu:24.04
installs, 18.19.1, which is below what engines allows since the floor went
to 22.12. They now use the runner's Node 22, bound into the container.
---
 .github/workflows/integration-tests.yml | 24 +++++++++++++++++-------
 1 file changed, 17 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/integration-tests.yml b/.github/workflows/integration-tests.yml
index 9672416e0..df033d7cd 100644
--- a/.github/workflows/integration-tests.yml
+++ b/.github/workflows/integration-tests.yml
@@ -296,6 +296,12 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
+      # For the container below, which runs the built CLI with it.
+      - name: Setup Node.js
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        with:
+          node-version: '22'
+
       - name: Enable unprivileged user namespaces on host
         run: |
           sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0 || true
@@ -313,19 +319,23 @@ jobs:
             --security-opt seccomp=unconfined \
             --security-opt apparmor=unconfined \
             -v "${{ github.workspace }}:/work" \
+            -v "$(dirname "$(dirname "$(command -v node)")")":/opt/node:ro \
             -w /work \
             -e SRT_E2E_DOCKER=1 \
             ubuntu:24.04 \
             bash -euo pipefail -c '
               apt-get update -qq
-              # node and npm come from the image instead of a second piped
-              # installer, and bun is pinned to the version the rest of the
-              # matrix runs (oven-sh/setup-bun above). The tree carries a
-              # dozen bun-version-specific workarounds, so "whatever bun
-              # shipped this morning" is not the runtime under test.
-              apt-get install -y -qq bubblewrap socat ripgrep python3 curl ca-certificates unzip gcc libseccomp-dev libcap2-bin nodejs npm
+              # node and npm are those of the runner, bound in: no second
+              # piped installer, and not those of the image, which has Node
+              # 18, below what engines in package.json allows. bun is pinned
+              # to the version the rest of the matrix runs (oven-sh/setup-bun
+              # above). The tree carries a dozen bun-version-specific
+              # workarounds, so "whatever bun shipped this morning" is not
+              # the runtime under test.
+              apt-get install -y -qq bubblewrap socat ripgrep python3 curl ca-certificates unzip gcc libseccomp-dev libcap2-bin
               curl -fsSL https://bun.sh/install | bash -s bun-v1.4.2
-              export PATH="$HOME/.bun/bin:$PATH"
+              export PATH="/opt/node/bin:$HOME/.bun/bin:$PATH"
+              node --version
               npm ci
               npm run build:seccomp
               npm run build