tech(Build): pin patched node versions across workflows

.github/workflows/azure-static-web-apps-orange-rock-0d4f87503.yml

@@ -35,6 +35,10 @@ jobs:
           # Tags and full history: git-cliff derives the version from the commits
           # since the last release, and a shallow clone has neither.
           fetch-depth: 0
+      - name: Use the project Node.js version
+        uses: actions/setup-node@v7
+        with:
+          node-version-file: '.nvmrc'
       # The version the Release workflow is about to tag, derived from the same
       # cliff.toml on the same commit so the deployed bundle and the tag always
       # agree. Nothing is written to the repository — it only travels as an env
@@ -55,22 +59,30 @@ jobs:
           fi
           echo "value=$VERSION" >> "$GITHUB_OUTPUT"
           echo "Building Grottocenter $VERSION"
-      - name: Build And Deploy
-        id: builddeploy
-        uses: Azure/static-web-apps-deploy@v1
+      # The deployment image uses Oryx on Debian bullseye, whose Node 24
+      # catalog stops at 24.13.0. Build here to use the patched project version.
+      - name: Install dependencies
+        run: node .yarn/releases/yarn-4.5.0.cjs install --immutable
+        env:
+          CYPRESS_INSTALL_BINARY: 0
+      - name: Build app
+        run: node .yarn/releases/yarn-4.5.0.cjs build
         env:
-          NODE_VERSION: 24
           VITE_TURNSTILE_SITE_KEY: ${{ secrets.VITE_TURNSTILE_SITE_KEY }}
           VITE_APP_VERSION: ${{ steps.version.outputs.value }}
+      - name: Deploy built app
+        id: builddeploy
+        uses: Azure/static-web-apps-deploy@v1
         with:
           azure_static_web_apps_api_token: ${{ secrets.AZURE_STATIC_WEB_APPS_API_TOKEN_ORANGE_ROCK_0D4F87503 }}
           repo_token: ${{ secrets.GITHUB_TOKEN }} # Used for Github integrations (i.e. PR comments)
           action: "upload"
           ###### Repository/Build Configurations - These values can be configured to match your app requirements. ######
           # For more information regarding Static Web App workflow configurations, please visit: https://aka.ms/swaworkflowconfig
-          app_location: "." # App source code path
+          app_location: "packages/web-app/dist" # Built app content directory
           api_location: "" # No Azure Functions API in this repo
-          output_location: "packages/web-app/dist" # Built app content directory (Vite outputs to dist/)
+          output_location: ""
+          skip_app_build: true
           ###### End of Repository/Build Configurations ######
 
   close_pull_request_job:

.github/workflows/lint.yml

@@ -16,20 +16,19 @@ on:
 # A workflow run is made up of one or more jobs that can run sequentially or in parallel
 jobs:
   build:
+    # Preserve the existing check name without a single-version matrix.
+    name: build (24)
     # The type of runner that the job will run on
     runs-on: ubuntu-latest
-    strategy:
-      matrix:
-        node: [24]
 
     # Steps represent a sequence of tasks that will be executed as part of the job
     steps:
       # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
       - uses: actions/checkout@v5
-      - name: Use Node.js ${{ matrix.node }}
+      - name: Use the project Node.js version
         uses: actions/setup-node@v7
         with:
-          node-version: ${{ matrix.node }}
+          node-version-file: '.nvmrc'
           cache: 'yarn'
       - name: Install dependencies
         run: yarn install

.github/workflows/release.yml

@@ -34,6 +34,11 @@ jobs:
           # the last release, neither of which exist in a shallow clone.
           fetch-depth: 0
 
+      - name: Use the project Node.js version
+        uses: actions/setup-node@v7
+        with:
+          node-version-file: '.nvmrc'
+
       - name: Compute the version
         id: next
         run: |

.github/workflows/test.yml

@@ -17,10 +17,10 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v5
-      - name: Use Node.js 24
+      - name: Use the project Node.js version
         uses: actions/setup-node@v7
         with:
-          node-version: 24
+          node-version-file: '.nvmrc'
           cache: 'yarn'
       - name: Install dependencies
         run: yarn
@@ -34,10 +34,10 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v5
-      - name: Use Node.js 24
+      - name: Use the project Node.js version
         uses: actions/setup-node@v7
         with:
-          node-version: 24
+          node-version-file: '.nvmrc'
           cache: 'yarn'
       - name: List E2E specs
         id: specs
@@ -96,10 +96,10 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v5
-      - name: Use Node.js 24
+      - name: Use the project Node.js version
         uses: actions/setup-node@v7
         with:
-          node-version: 24
+          node-version-file: '.nvmrc'
           cache: 'yarn'
       - name: Restore built app
         uses: actions/download-artifact@v4
@@ -120,6 +120,9 @@ jobs:
       - name: Cypress run
         uses: cypress-io/github-action@v7
         with:
+          # Run the CLI with setup-node's Node instead of the action's runtime.
+          # Prevent npx from downloading a different Cypress version.
+          command-prefix: '--no-install'
           browser: ${{ steps.chrome.outputs.chrome-path || matrix.browser }}
           spec: ${{ matrix.spec }}
           project: packages/web-app

.github/workflows/translations.yml

@@ -9,18 +9,17 @@ on:
 
 jobs:
   check-translations:
+    # Preserve the existing check name without a single-version matrix.
+    name: check-translations (24)
     runs-on: ubuntu-latest
-    strategy:
-      matrix:
-        node: [24]
 
     steps:
       - uses: actions/checkout@v4
 
-      - name: Use Node.js ${{ matrix.node }}
+      - name: Use the project Node.js version
         uses: actions/setup-node@v7
         with:
-          node-version: ${{ matrix.node }}
+          node-version-file: '.nvmrc'
           cache: 'yarn'
 
       - name: Install dependencies

.nvmrc

@@ -1 +1 @@
-v24.20.0
+v24.22.1

README.md

@@ -2,7 +2,7 @@
 
 [![Lint](https://github.com/GrottoCenter/grottocenter-front/actions/workflows/lint.yml/badge.svg?branch=develop)](https://github.com/GrottoCenter/grottocenter-front/actions/workflows/lint.yml)
 [![Test](https://github.com/GrottoCenter/grottocenter-front/actions/workflows/test.yml/badge.svg?branch=develop)](https://github.com/GrottoCenter/grottocenter-front/actions/workflows/test.yml)
-[![Node](https://img.shields.io/badge/node-%3E%3D24.15-brightgreen)](https://nodejs.org/)
+[![Node](https://img.shields.io/badge/node-24.22.1_LTS-brightgreen)](https://nodejs.org/)
 [![Uptime](https://uptime.betterstack.com/status-badges/v2/monitor/29ko2.svg)](https://wikicaves.betteruptime.com)
 
 Web app frontend for [Grottocenter](https://fr.wikicaves.org/), the Wiki database made by cavers for cavers, maintained by [Wikicaves](https://fr.wikicaves.org/).
@@ -14,11 +14,21 @@ This project uses [Yarn](https://yarnpkg.com/) & [Yarn workspaces](https://yarnp
 
 ## 🚀 Getting Started
 
-- Install [Node.js](https://nodejs.org) (v24.15 minimum, v24.20.0 recommended) and [Yarn](https://yarnpkg.com/getting-started/install)
+- Install [Node.js](https://nodejs.org) (use the version in [`.nvmrc`](.nvmrc), currently v24.22.1) and [Yarn](https://yarnpkg.com/getting-started/install)
 - Install [Git](https://git-scm.com/downloads) (v2.32.0 minimum for the commit hooks)
 - Run `yarn` to install dependencies
 - Run `yarn start` to launch the app
 
+Node 24.22.1+ within the 24.x line and Node 26.12.1+ are accepted; Node 25 is
+excluded because it is end-of-life. CI uses the exact version in `.nvmrc`.
+For a Node security update, update `.nvmrc` and both `engines.node` fields
+(`package.json` and `packages/web-app/package.json`), then verify the runtime
+versions in the CI logs. GitHub Actions also have their own Node runtimes,
+which are supplied by the runner and are not changed by `setup-node`.
+Cypress/Electron also bundles Node separately. Check its version with
+`npx --no-install cypress version` when updating Cypress; `.nvmrc` does not
+update that runtime.
+
 ### Configuration
 
 By default the app uses the production API as backend. To change it, edit the `VITE_API_URL` variable in `packages/web-app/.env`.
@@ -69,6 +79,10 @@ guide: PWA/service-worker setup, keystore generation, Play App Signing,
 
 ## ☁️ Production deployment (Azure)
 
+The workflow builds with the Node version from `.nvmrc` and the committed Yarn
+release, then uploads `packages/web-app/dist` with `skip_app_build: true`.
+This avoids Oryx selecting an older Node version in the deployment container.
+
 [Full wiki article](https://github.com/GrottoCenter/grottocenter-front/wiki/Production-deployment-(Azure))
 
 ## 🤖 AI Agents

package.json

@@ -58,7 +58,7 @@
     "typescript": "6.0.3"
   },
   "engines": {
-    "node": ">=24.15",
+    "node": "^24.22.1 || >=26.12.1",
     "yarn": "4.5.0"
   },
   "packageManager": "yarn@4.5.0",

packages/web-app/package.json

@@ -100,6 +100,6 @@
     "vitest": "^4.1.11"
   },
   "engines": {
-    "node": ">=24.15"
+    "node": "^24.22.1 || >=26.12.1"
   }
 }