[WIP] Fix failing GitHub Actions job Create GitHub Release

[Copilot]

Thanks for asking me to work on this. I will get started on it and keep this PR's description up to date as I form a plan and make progress.

Fix the failing GitHub Actions job "Create GitHub Release"
Analyze the Actions logs, identify the root cause of the failure, and implement a fix.
Check run ID: 105638448915
Job URL: https://github.com/advanced-security/codeql-development-mcp-server/actions/runs/34808716205/job/105638448915

[Copilot]

Copilot wasn't able to review any files in this pull request.

[Copilot]

🔵 Needs a closer look

The release artifact excludes .node-version, so Node.js setup will fail unless hidden files are included or the repository is checked out.

Review details

Suppressed comments (1)

.github/workflows/release.yml:219

• This job does not check out the repository, so this file must come from the downloaded release-build artifact. However, the producer uploads .node-version without include-hidden-files: true, and upload-artifact@v7 excludes hidden files by default; setup-node will therefore fail to resolve this file before npm runs. Update the artifact upload to include the hidden file (or check out the tag before this step) so the Node setup actually fixes the failing install.

          node-version-file: '.node-version'

• Files reviewed: 1/1 changed files
• Comments generated: 0 new
• Review effort level: Lite

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
actions/actions/setup-node	820762786026740c76f36085b0efc47a31fe5020	🟢 6.4	Details Check Score Reason Code-Review 🟢 10 all changesets reviewed Maintained 🟢 10 21 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10 Binary-Artifacts 🟢 9 binaries present in source code Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Packaging ⚠️ -1 packaging workflow not detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Pinned-Dependencies 🟢 5 dependency not pinned by hash detected -- score normalized to 5 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Security-Policy 🟢 9 security policy file detected Branch-Protection ⚠️ 0 branch protection not enabled on development/release branches SAST 🟢 10 SAST tool is run on all commits

Scanned Files

• .github/workflows/release.yml

[data-douser]

🔵 Needs a closer look

The release artifact excludes .node-version, so Node.js setup will fail unless hidden files are included or the repository is checked out.

Review details

Suppressed comments (1)

.github/workflows/release.yml:219

• This job does not check out the repository, so this file must come from the downloaded release-build artifact. However, the producer uploads .node-version without include-hidden-files: true, and upload-artifact@v7 excludes hidden files by default; setup-node will therefore fail to resolve this file before npm runs. Update the artifact upload to include the hidden file (or check out the tag before this step) so the Node setup actually fixes the failing install.

          node-version-file: '.node-version'

• Files reviewed: 1/1 changed files
• Comments generated: 0 new
• Review effort level: Lite

@copilot Improve htis

[Copilot]

🔵 Needs a closer look

The release artifact excludes .node-version, so Node.js setup will fail unless hidden files are included or the repository is checked out.

...

Fixed in c218a28: enabled include-hidden-files: true on the scoped release-build upload so .node-version reaches Node setup. Formatting, secret scan, CodeQL, and fallback review passed. Build/tests and lint were blocked by sandbox Go 1.25.0 (project requires 1.25.5).

[Copilot]

🟢 Approval recommended

The release workflow fixes are complete with no unresolved issues.

Review details

• Files reviewed: 2/2 changed files
• Comments generated: 0 new
• Review effort level: Lite

[Copilot]

🟢 Approval recommended

The coordinated workflow changes directly address the runtime mismatch shown in the failed job.

Review details

• Files reviewed: 2/2 changed files
• Comments generated: 0 new
• Review effort level: Balanced