fix: pin the Node version in the shared build surface

.github/actions/purview-build/action.yml

@@ -18,6 +18,13 @@ inputs:
     description: .NET SDK used by the consuming repository.
     required: false
     default: 10.0.x
+  node-version:
+    description: >-
+      Node.js used by the consuming repository's JavaScript tooling (for example Astro, which
+      refuses to run below its minimum). Pinned rather than inherited from the runner image,
+      whose Node version drifts between builds.
+    required: false
+    default: 26.x
   config-path:
     description: >-
       Explicit purview-build.json location (PURVIEW_BUILD_CONFIG). When omitted, the tool uses its
@@ -47,6 +54,12 @@ runs:
 
     - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
 
+    # JavaScript tooling (Astro and anything it shells out to) checks `process.versions.node`
+    # and refuses to run below its minimum. The runner image's Node drifts, so pin it.
+    - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
+      with:
+        node-version: ${{ inputs.node-version }}
+
     # Same implementation the reusable workflows use. Registered before the tool install so a
     # build-version that exists only on GitHub Packages is resolvable.
     # A composite action has no post-step, so this configuration lasts for the rest of the job; the

.github/workflows/purview-build.yml

@@ -17,6 +17,14 @@ on:
         required: false
         default: 10.0.x
         type: string
+      node-version:
+        description: >-
+          Node.js used by the consuming repository's JavaScript tooling (for example Astro, which
+          refuses to run below its minimum). Pinned rather than inherited from the runner image,
+          whose Node version drifts between builds.
+        required: false
+        default: 26.x
+        type: string
       release-mode:
         description: Release__Mode passed to the pipeline (None, NuGet, or GitHubRelease; LocalNuGet only works when run locally, not from a workflow).
         required: false
@@ -123,6 +131,13 @@ jobs:
 
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
 
+      # JavaScript tooling (Astro and anything it shells out to) checks `process.versions.node`
+      # and refuses to run below its minimum. The runner image's Node drifts, so a build that
+      # passed can fail later when the image ships a Node below a tool's floor; pin it instead.
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
+        with:
+          node-version: ${{ inputs.node-version }}
+
       # Registered before the tool install so a build-version that exists only on GitHub Packages (a
       # version NuGet.org has not indexed yet) is resolvable. It is also before the repository's own
       # restores. Credentials are resolved from a macro at restore time, so nothing secret is written.

.github/workflows/purview-release.yml

@@ -17,6 +17,14 @@ on:
         required: false
         default: 10.0.x
         type: string
+      node-version:
+        description: >-
+          Node.js used by the consuming repository's JavaScript tooling (for example Astro, which
+          refuses to run below its minimum). Pinned rather than inherited from the runner image,
+          whose Node version drifts between builds.
+        required: false
+        default: 26.x
+        type: string
       release-mode:
         description: Release__Mode passed to the pipeline (NuGet or GitHubRelease).
         required: false
@@ -116,6 +124,7 @@ jobs:
         with:
           build-version: ${{ inputs.build-version }}
           dotnet-version: ${{ inputs.dotnet-version }}
+          node-version: ${{ inputs.node-version }}
           release-mode: ${{ inputs.release-mode }}
           config-path: ${{ inputs.config-path }}
           eligibility-policy: ${{ inputs.eligibility-policy }}

actions/purview-release/action.yml

@@ -30,6 +30,13 @@ inputs:
       fails the job.
     required: false
     default: 10.0.x
+  node-version:
+    description: >-
+      Node.js used by the consuming repository's JavaScript tooling (for example Astro, which
+      refuses to run below its minimum). Pinned rather than inherited from the runner image,
+      whose Node version drifts between builds.
+    required: false
+    default: 26.x
   release-mode:
     description: Release__Mode passed to the pipeline (NuGet or GitHubRelease).
     required: false
@@ -174,6 +181,12 @@ runs:
 
     - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
 
+    # JavaScript tooling (Astro and anything it shells out to) checks `process.versions.node`
+    # and refuses to run below its minimum. The runner image's Node drifts, so pin it.
+    - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
+      with:
+        node-version: ${{ inputs.node-version }}
+
     # Before the tool install, so a build-version that exists only on GitHub Packages is resolvable.
     # A fork pull request cannot read the private feed (no organisation secrets), so leave it on
     # NuGet.org rather than registering a source every restore would be denied.