Set up Node in the Go release, the latest unless pinned

.github/workflows/go-release.yml

@@ -12,7 +12,8 @@
 #       with:
 #         tag: ${{ inputs.tag || github.ref_name }}
 #
-# Optional: runs-on (a macOS runner for a project whose darwin build needs cgo), environment (a
+# Optional: node-version (default: the latest Node, for a before-hook that builds a web UI),
+# runs-on (a macOS runner for a project whose darwin build needs cgo), environment (a
 # GitHub environment the job runs under, such as `release`), and the SIGNPATH_API_TOKEN secret,
 # passed explicitly (`secrets: SIGNPATH_API_TOKEN: ${{ secrets.SIGNPATH_API_TOKEN }}`, never
 # `secrets: inherit`) for a GoReleaser config that signs through SignPath.
@@ -72,6 +73,13 @@ on:
         required: false
         type: string
         default: ''
+      node-version:
+        description: >-
+          Node.js for a GoReleaser before-hook that builds a web UI, such as 22. Defaults to the
+          latest release (owner, 2026-11-13: "default should always be the latest version").
+        required: false
+        type: string
+        default: latest
     secrets:
       SIGNPATH_API_TOKEN:
         description: 'SignPath API token, exported to GoReleaser for a config that signs through SignPath'
@@ -139,6 +147,13 @@ jobs:
           go-version-file: ${{ inputs.go-version-file }}
           cache-dependency-path: ${{ inputs.module-alias-prefix }}go.sum
 
+      # A project whose GoReleaser before-hooks build a web UI needs Node; the latest release
+      # unless the caller pins one (browser-foreman passes 22, matching its CI).
+      - name: Set up Node
+        uses: actions/setup-node@v7
+        with:
+          node-version: ${{ inputs.node-version }}
+
       # syft generates GoReleaser's per-archive SBOMs; cosign signs checksums.txt where the config asks.
       - name: Install syft
         uses: anchore/sbom-action/download-syft@66cbf4bc1f1c0d2edc94016e65bc221b6bb0ad6c # v0.24.3

go-release/README.md

@@ -23,6 +23,7 @@ Push a version tag only for final code: tags are final, and a pushed tag publish
 | `go-version-file` | `src/go.mod` | the `go.mod` that pins the Go version |
 | `module-alias-prefix` | `src/` | the module's subdirectory, for its `src/vX.Y.Z` alias tag; empty for none |
 | `changelog` | `CHANGELOG.md` | its `## [X.Y.Z]` section becomes the release notes |
+| `node-version` | `latest` | Node.js for a before-hook that builds a web UI; the latest release unless pinned (`22`) |
 | `post-release` | empty | a command run after GoReleaser to attach extra assets; it may write `$RUNNER_TEMP/extra-checksums.txt` to have them attested |
 | `runs-on` | `ubuntu-latest` | the runner label for the job; `macos-latest` for a project whose darwin build needs cgo |
 | `environment` | empty | a GitHub environment the job runs under (for example `release`); empty for none |

go-release/tests/test_go_release.py

@@ -89,6 +89,13 @@ def test_attestations_skip_a_private_repository(self):
             self.assertRegex(st, r"\n        if: .*github\.event\.repository\.private == false", st)
 
 
+    def test_node_defaults_to_the_latest_release(self):
+        m = re.search(r"\n      node-version:\n(?:        .*\n)*?        default: (\S+)", self.text)
+        self.assertIsNotNone(m, "no node-version input")
+        self.assertEqual(m.group(1), "latest")
+        self.assertIn("node-version: ${{ inputs.node-version }}", self.text)
+
+
 class CallerTemplate(unittest.TestCase):
     def setUp(self):
         self.text = TEMPLATE.read_text()