🏗️✨：check the runtime pins still agree

[DerekNonGeneric]

Ported from OpenINF/.github, where this landed as 966b995.

Three files name a version and all three have to say the same thing: .nvmrc is what nvm reads for a bare nvm use, engines is what pnpm enforces and what setup-node is pointed at, and packageManager is the version pnpm fetches to run as.

Only one of those pairs was guarded, and only in the dev container. post-create.sh compares .nvmrc against engines.node and stops if they differ, but it runs when somebody builds a container and nowhere else. CI reads package.json alone, so a change that moved one and left the other would pass every check and then fail for the next person to open the container.

The packageManager / engines.pnpm pair had nothing watching it at all, and it is the worse of the two: pnpm fetches the version the first names and then holds itself to the second, so a disagreement fails every install rather than one shell.

engineStrict is checked as well, because everything else rests on it. Without it engines is a note rather than a requirement, and a task confirming three files agree would be reporting success over a promise nothing keeps.

How it was checked

• Passes here: Node 24.20.0 and pnpm 11.25.0 agree across all three files, and engineStrict: true is at column zero in pnpm-workspace.yaml.
• Not passing vacuously: moving .nvmrc to 24.19.0 is reported with exit 1.
• A trailing # comment after engineStrict: true is still accepted, as intended.
• Imports nothing but node:fs/promises, so it runs before anything is installed — which is what lets post-create.sh call it.

Ordering

• Best landed after "hold the workflows to their own pinning rule" (🏗️✨：hold the workflows to their own pinning rule #1887); the doc comment here names verify.workflows.
• Before "fix the container's hang and its moving pins", whose post-create.sh calls this task instead of repeating the comparison.

Summary by CodeRabbit

• Chores
  • Added automated verification to detect inconsistencies among the project’s required Node.js and pnpm versions.
  • Validation now reports all runtime configuration mismatches and fails the check when requirements are not aligned.

[netlify]

✅ Deploy Preview for gh-pages-openinf ready!

Name	Link
🔨 Latest commit	25f7fa2
🔍 Latest deploy log	https://app.netlify.com/projects/gh-pages-openinf/deploys/6a9e291d5d62f10008d9ce2e
😎 Deploy Preview	https://deploy-preview-1888--gh-pages-openinf.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: 9f75f4a8-389f-45db-bb25-7c5b656fd637

📥 Commits

Reviewing files that changed from the base of the PR and between fa956d0 and 25f7fa2.

📒 Files selected for processing (2)

• build/tasks/verify/verify-runtimes.mts
• package-scripts.yml

Included review availability: Your plan provides up to 8 included reviews per hour; 6 remain after this review.

---

📝 Walkthrough

Walkthrough

The PR adds a runtime verification script. It cross-checks Node and pnpm versions across package.json, .nvmrc, and pnpm-workspace.yaml. It reports all mismatches and exposes the check through a package script.

Changes

Runtime consistency verification

Layer / File(s)	Summary
Runtime input parsing build/tasks/verify/verify-runtimes.mts	The script loads runtime configuration from package.json, .nvmrc, and pnpm-workspace.yaml. It parses engine versions, package-manager versions, integrity suffixes, comments, and CRLF endings.
Runtime validation and task wiring build/tasks/verify/verify-runtimes.mts, package-scripts.yml	The script validates exact Node and pnpm versions, checks engineStrict: true, compares runtime sources, reports all detected problems, and sets a failing exit code. The runtimes task invokes the script.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Merge Risk: ⚪ Minimal · up to 25f7f

This adds a runtime pin consistency check that reports configuration mismatches before dependent tooling runs. The current implementation is ready to merge with no identified active risk.

Sequence Diagram(s)

sequenceDiagram
  participant PackageTask as package-scripts.yml
  participant VerifyRuntimes as verify-runtimes.mts
  participant RuntimeFiles as Runtime configuration files
  PackageTask->>VerifyRuntimes: run runtimes verification task
  VerifyRuntimes->>RuntimeFiles: validate and compare configured versions
  RuntimeFiles-->>VerifyRuntimes: return runtime configuration
  VerifyRuntimes-->>PackageTask: report problems or successful versions

Loading

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes the main change: checking that runtime version pins remain consistent across the project.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch infra/pin-the-runtimes-together

---

_{Comment @coderabbitai help to get the list of available commands.}