[vegadlyra]

The proposed separate Webpack workflow duplicated the repository build and used unsupported Node versions and undeclared tooling. This change keeps the shared Build package job as the build owner and pins its checkout/setup-node actions to full commit SHAs. The existing .nvmrc toolchain, npm ci, artifact cache, and read-only permissions remain the source of build behavior.

Validation: source inspection only. Tests and checks were skipped at the user's explicit request.

[chatgpt-codex-connector]

Codex usage limits have been reached for code reviews. Please check with the admins of this repo to increase the limits by adding credits.
Repo admins can enable using credits for code reviews in their settings.

[vegadlyra]

ok

[vegadlyra]

ok

[morluto]

@greptileai review

[greptile-apps]

This PR is set for a Plus review. TREX isn't supported with Plus or Apex reviews yet, so Greptile reviews this PR at Base while TREX is on.

[greptile-apps]

Confidence Score: 5/5

[High impact] The PR appears safe to merge; the duplicate build was removed and no new blocking issue remains.

Summary

The final change pins actions/checkout and actions/setup-node in the existing shared build job.

• The package build job pins checkout and Node setup to exact commits.

_{Reviews (3) · Last reviewed commit: "ci: pin actions in the existing shared N..." · Reviewed by Greptile}

[cursor]

Closing this in favor of #1901. This pull request pins two Actions SHAs in one CI job. #1901 pins those same SHAs across the workflows.

[morluto]

Review findings addressed at their producing boundaries and consumers. Latest changes were reviewed from source; tests and provider runs were skipped at the maintainer's request. Findings requiring separate decisions or verification remain open.

1. thread 1

The additional Node build duplicated the shared CI build. The new webpack workflow has been removed; the existing Build package job remains the single owner of dependency installation, pinned .nvmrc toolchain, compilation, artifact publication, and build cache. Its checkout/setup-node actions are now pinned to the full SHAs, retaining its existing read-only permissions and cache authority.

Current source: 3a1d3e7. Validation: source inspection only; tests and checks were skipped at the user's explicit request.

[morluto]

@vegadlyra, thanks for keeping the Node build in the existing shared workflow and calling out the action-pin supply-chain risk. The current CI workflow preserves that build ownership and pins checkout and setup-node to commit SHAs (main).