Set up pinned Node in Rust CI jobs and drop unused tsjs deps

.claude/commands/check-ci.md

@@ -8,5 +8,6 @@ Run all CI checks locally, in order. Stop and report if any step fails.
 6. `cd crates/trusted-server-js/lib && npm run format`
 7. `cd docs && npm run format`
 8. `cargo run --manifest-path crates/trusted-server-cli/Cargo.toml --target "$(rustc -vV | sed -n 's/host: //p')" --bin ts -- dev lint domains --changed-vs origin/main` (use the PR's base branch in place of `main` when it targets another branch)
+9. `node --test scripts/check-ci-node-pin.test.mjs && node scripts/check-ci-node-pin.mjs`
 
 Report a summary of all results when done.

.github/actions/setup-integration-test-env/action.yml

@@ -39,6 +39,18 @@ runs:
       shell: bash
       run: echo "node-version=$(grep '^nodejs ' .tool-versions | awk '{print $2}')" >> "$GITHUB_OUTPUT"
 
+    # Pin Node before anything compiles trusted-server-core: its dependency on
+    # trusted-server-js runs the TSJS build with the `npm` on PATH. That covers
+    # the Rust builds below and the callers' later cargo steps, and callers use
+    # this Node directly too (e.g. `npm install -g wrangler`), so keep the step
+    # unconditional.
+    - name: Use Node.js for the TSJS build
+      uses: actions/setup-node@v4
+      with:
+        node-version: ${{ steps.node-version.outputs.node-version }}
+        cache: npm
+        cache-dependency-path: crates/trusted-server-js/lib/package-lock.json
+
     - name: Retrieve Viceroy version
       id: viceroy-version
       if: ${{ inputs.install-viceroy == 'true' }}

.github/workflows/format.yml

@@ -39,6 +39,30 @@ jobs:
             exit 1
           fi
 
+  check-ci-node-pin:
+    name: CI Node pin guard
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      # The guard's tests check the tree before the guard landed; fetch only
+      # that commit instead of the full history.
+      - name: Fetch the pre-guard commit
+        run: git fetch --no-tags --depth=1 origin 7a0ecb4cbfa39af3d83f7e1ed2733d7eabdc4cb1
+
+      - name: Use Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version-file: .tool-versions
+
+      - name: Test the guard
+        run: node --test scripts/check-ci-node-pin.test.mjs
+
+      # Every job that compiles trusted-server-core also runs the TSJS build, so
+      # it must set up the `.tool-versions` Node first (see issue #1204).
+      - name: Verify jobs pin Node before compiling Rust
+        run: node scripts/check-ci-node-pin.mjs
+
   format-rust:
     name: cargo fmt
     runs-on: ubuntu-latest
@@ -64,6 +88,15 @@ jobs:
           components: "clippy, rustfmt"
           cache-key: cargo-clippy
 
+      # trusted-server-core's dependency on trusted-server-js runs the TSJS
+      # build with the `npm` on PATH, so pin Node before any cargo step.
+      - name: Use Node.js for the TSJS build
+        uses: actions/setup-node@v4
+        with:
+          node-version-file: .tool-versions
+          cache: npm
+          cache-dependency-path: crates/trusted-server-js/lib/package-lock.json
+
       - name: Run cargo fmt
         uses: actions-rust-lang/rustfmt@v1
 

.github/workflows/integration-tests.yml

@@ -90,11 +90,6 @@ jobs:
       - name: Load integration test Docker images
         run: docker load --input "$DOCKER_ARTIFACT_PATH"
 
-      - name: Set up Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: ${{ steps.shared-setup.outputs.node-version }}
-
       - name: Install wrangler
         run: npm install -g wrangler
 

.github/workflows/test.yml

@@ -45,7 +45,9 @@ jobs:
         if: steps.cache-viceroy.outputs.cache-hit != 'true'
         run: cargo install viceroy --version "${{ steps.viceroy-version.outputs.viceroy-version }}" --locked --force
 
-      - name: Use Node.js for the served-seam contract
+      # trusted-server-core's dependency on trusted-server-js runs the TSJS
+      # build with the `npm` on PATH, so pin Node before any cargo step.
+      - name: Use Node.js for the TSJS build and the served-seam contract
         uses: actions/setup-node@v4
         with:
           node-version: ${{ steps.node-version.outputs.node-version }}
@@ -129,12 +131,15 @@ jobs:
           components: clippy
           cache-key: cargo-axum
 
-      - name: Read pinned Node.js version for CLI fixtures
+      - name: Read pinned Node.js version
         id: node-version
         shell: bash
         run: echo "version=$(awk '$1 == "nodejs" { print $2 }' .tool-versions)" >> "$GITHUB_OUTPUT"
 
-      - uses: actions/setup-node@v4
+      # trusted-server-core's dependency on trusted-server-js runs the TSJS
+      # build with the `npm` on PATH, so pin Node before any cargo step.
+      - name: Use Node.js for the TSJS build and the CLI fixtures
+        uses: actions/setup-node@v4
         with:
           node-version: ${{ steps.node-version.outputs.version }}
 
@@ -197,6 +202,15 @@ jobs:
           components: clippy
           cache-key: cargo-cloudflare
 
+      # trusted-server-core's dependency on trusted-server-js runs the TSJS
+      # build with the `npm` on PATH, so pin Node before any cargo step.
+      - name: Use Node.js for the TSJS build
+        uses: actions/setup-node@v4
+        with:
+          node-version-file: .tool-versions
+          cache: npm
+          cache-dependency-path: crates/trusted-server-js/lib/package-lock.json
+
       - name: Check Cloudflare adapter (native host)
         run: cargo check -p trusted-server-adapter-cloudflare
 
@@ -222,6 +236,15 @@ jobs:
           components: clippy
           cache-key: cargo-spin
 
+      # trusted-server-core's dependency on trusted-server-js runs the TSJS
+      # build with the `npm` on PATH, so pin Node before any cargo step.
+      - name: Use Node.js for the TSJS build
+        uses: actions/setup-node@v4
+        with:
+          node-version-file: .tool-versions
+          cache: npm
+          cache-dependency-path: crates/trusted-server-js/lib/package-lock.json
+
       - name: Check Spin adapter (native host)
         run: cargo check -p trusted-server-adapter-spin
 
@@ -258,6 +281,15 @@ jobs:
           components: clippy, rustfmt
           cache-key: cargo-parity
 
+      # trusted-server-core's dependency on trusted-server-js runs the TSJS
+      # build with the `npm` on PATH, so pin Node before any cargo step.
+      - name: Use Node.js for the TSJS build
+        uses: actions/setup-node@v4
+        with:
+          node-version-file: .tool-versions
+          cache: npm
+          cache-dependency-path: crates/trusted-server-js/lib/package-lock.json
+
       - name: Format check (parity test crate)
         run: cargo fmt --manifest-path crates/trusted-server-integration-tests/Cargo.toml -- --check
 
@@ -283,12 +315,15 @@ jobs:
           components: "clippy, rustfmt"
           cache-key: cargo-cli
 
-      - name: Read pinned Node.js version for CLI fixtures
+      - name: Read pinned Node.js version
         id: node-version
         shell: bash
         run: echo "version=$(awk '$1 == "nodejs" { print $2 }' .tool-versions)" >> "$GITHUB_OUTPUT"
 
-      - uses: actions/setup-node@v4
+      # trusted-server-core's dependency on trusted-server-js runs the TSJS
+      # build with the `npm` on PATH, so pin Node before any cargo step.
+      - name: Use Node.js for the TSJS build and the CLI fixtures
+        uses: actions/setup-node@v4
         with:
           node-version: ${{ steps.node-version.outputs.version }}
 

AGENTS.md

@@ -374,6 +374,7 @@ Every PR must pass:
 10. Wasm clock lint: `scripts/lint-wasm-clock.sh` (crates built into the Cloudflare Worker must use `web_time`, not the `std::time::{Instant,SystemTime}` `now`/`elapsed` methods, which panic there)
 11. Documentation proposal scripts: `shellcheck scripts/docs-proposal/*.sh && node --test scripts/docs-proposal/hunks.test.mjs && scripts/docs-proposal/test.sh`
 12. URL-host linter on lines the PR adds (`lint-domains` job, PRs only); run it locally with `cargo run --manifest-path crates/trusted-server-cli/Cargo.toml --target <host-triple> --bin ts -- dev lint domains --changed-vs origin/main`, using the PR's base branch in place of `main` when it targets another branch
+13. CI Node pin guard: `node --test scripts/check-ci-node-pin.test.mjs && node scripts/check-ci-node-pin.mjs` with the `.tool-versions` Node (every CI job that compiles Rust sets up the `.tool-versions` Node before its first cargo step)
 
 CI also runs these HTML EOF checks. Run them locally only when changing EOF
 finalization, publisher or HTML-processor code:

crates/trusted-server-adapter-cloudflare/Cargo.toml

@@ -33,7 +33,6 @@ futures = { workspace = true }
 log = { workspace = true }
 serde_json = { workspace = true }
 trusted-server-core = { workspace = true }
-trusted-server-js = { workspace = true }
 worker = { workspace = true, optional = true }
 
 [target.'cfg(target_arch = "wasm32")'.dependencies]

crates/trusted-server-adapter-spin/Cargo.toml

@@ -34,7 +34,6 @@ futures = { workspace = true }
 http-body-util = { workspace = true }
 log = { workspace = true }
 trusted-server-core = { workspace = true }
-trusted-server-js = { workspace = true }
 
 [target.'cfg(target_arch = "wasm32")'.dependencies]
 spin-sdk = { workspace = true }

scripts/README.md

@@ -7,6 +7,7 @@ their documented orchestration handles a probe deliberately.
 | ----------------------------------------- | -------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | `batch-sync.sh`                           | Endpoint, bearer token, EC ID, partner UID; `curl` and Python              | Sends one authenticated batch-sync request. Its temporary response file is removed on exit.                                                                                                                                                                                                        |
 | `benchmark.sh`                            | A running server; `curl`, `bc`, and optionally `hey`                       | May install `hey` through Homebrew. `--save` writes under `benchmark-results/`; it does not stop the server.                                                                                                                                                                                       |
+| `check-ci-node-pin.mjs`                   | Pinned Node; tests in `check-ci-node-pin.test.mjs`                         | Read-only. Fails when a CI job compiles Rust before an unconditional `actions/setup-node` step pinned to `.tool-versions`; `--root` checks another checkout.                                                                                                                                       |
 | `profile.sh`                              | Fastly CLI, Rust WASM target, `curl`; endpoint and request options         | Builds and starts the Fastly app, stops the owned process, and retains a profile under `benchmark-results/profiles/`. `--open` launches the local viewer.                                                                                                                                          |
 | `generate-integration-viceroy-configs.sh` | Rust toolchain; optional origin port and artifact directory                | Builds the native generator and writes Viceroy config under `target/integration-test-artifacts/`; generated files persist.                                                                                                                                                                         |
 | `integration-tests.sh`                    | Docker, Viceroy, Rust WASM target, pinned Node                             | Builds WASM/native artifacts and two Docker images, generates Viceroy config, and runs native integration tests serially. Build products and images persist.                                                                                                                                       |