From 744b39b0061fe3a59f4d8f7ca71ba6519498bb55 Mon Sep 17 00:00:00 2001
From: Ervins Strauhmanis <17160191+resoltico@users.noreply.github.com>
Date: Fri, 1 May 2026 10:28:53 +0300
Subject: [PATCH] ci: drop node20 workflow shims

---
 .github/workflows/publish.yml       |  7 ++-----
 .github/workflows/test.yml          |  3 ---
 tests/test_architecture_contract.py | 30 +++++++++++++++++++++++++++++
 3 files changed, 32 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 103383e..dbe4537 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -20,9 +20,6 @@ permissions:
   contents: write
   id-token: write
 
-env:
-  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
-
 concurrency:
   group: publication-${{ github.workflow }}-${{ inputs.release_tag || github.ref_name }}
   cancel-in-progress: true
@@ -149,7 +146,7 @@ jobs:
 
       - name: Upload coverage reports to Codecov
         if: matrix.python-version == '3.14'
-        uses: codecov/codecov-action@75cd11691c0faa626561e295848008c8a7dddffe # v5
+        uses: codecov/codecov-action@57e3a136b779b570ffcdbf80b3bdc90e7fab3de2 # v6.0.0
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
           files: coverage.xml
@@ -436,7 +433,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 20
     steps:
-      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: pypi-dist
           path: dist/
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 623dfb6..af33804 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -9,9 +9,6 @@ on:
 permissions:
   contents: read
 
-env:
-  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
-
 concurrency:
   group: test-${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
diff --git a/tests/test_architecture_contract.py b/tests/test_architecture_contract.py
index df620f6..b091c69 100644
--- a/tests/test_architecture_contract.py
+++ b/tests/test_architecture_contract.py
@@ -541,3 +541,33 @@ def test_canonical_split_surfaces_are_git_tracked() -> None:
         )
 
     assert expected <= tracked_paths
+
+
+def test_release_workflows_do_not_depend_on_node20_compatibility_shims() -> None:
+    """Workflow pins must be natively Node 24-capable, not forced through overrides."""
+    publish_workflow = (REPO_ROOT / ".github" / "workflows" / "publish.yml").read_text(
+        encoding="utf-8"
+    )
+    test_workflow = (REPO_ROOT / ".github" / "workflows" / "test.yml").read_text(
+        encoding="utf-8"
+    )
+
+    assert "FORCE_JAVASCRIPT_ACTIONS_TO_NODE24" not in publish_workflow
+    assert "FORCE_JAVASCRIPT_ACTIONS_TO_NODE24" not in test_workflow
+
+    assert (
+        "codecov/codecov-action@75cd11691c0faa626561e295848008c8a7dddffe"
+        not in publish_workflow
+    )
+    assert (
+        "actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093"
+        not in publish_workflow
+    )
+
+    assert (
+        "codecov/codecov-action@57e3a136b779b570ffcdbf80b3bdc90e7fab3de2"
+        in publish_workflow
+    )
+    assert publish_workflow.count(
+        "actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c"
+    ) >= 3