ci: read the build Node version from .nvmrc

`node-version: 24` was repeated in thirteen setup-node steps across seven
workflows with no single source. The number now lives in .nvmrc and
every step that follows a checkout reads it with `node-version-file`.

The one exception is the Vale publish job, which deliberately checks
nothing out while it holds an OIDC identity, so there is no file for
setup-node to read; it keeps a literal `node-version: 24` with a comment
pointing at .nvmrc.

24 is the choice because it is the Active LTS line today
(nodejs/Release schedule.json: LTS since 2025-10-28, maintenance from
2026-10-20). The Current line, 26, does not become LTS until 2026-10-28,
seven weeks out, and the local toolchain runs 24.14.0. packages/cli's
`engines.node` is a consumer-facing floor and is untouched.

Author: theCodeDrift

.github/workflows/demo-rule.yml

@@ -57,7 +57,7 @@ jobs:
       - name: Setup Node
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: 24
+          node-version-file: .nvmrc
 
       - name: Install dependencies
         run: pnpm install --frozen-lockfile

.github/workflows/release-cli-changeset.yml

@@ -53,7 +53,7 @@ jobs:
       - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: 24
+          node-version-file: .nvmrc
           cache: pnpm
       - run: pnpm install --frozen-lockfile --ignore-scripts
 

.github/workflows/release-cli-nightly.yml

@@ -294,7 +294,7 @@ jobs:
           echo "Building from ${actual}, which Validate passed on."
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: 24
+          node-version-file: .nvmrc
 
       # No dependency install in this job, by design — gate 1 is the reason the
       # workflow can decide before installing anything, and nightly-pack.cjs is
@@ -514,7 +514,7 @@ jobs:
       # NODE_AUTH_TOKEN in env until v7).
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: 24
+          node-version-file: .nvmrc
           cache: pnpm
           registry-url: https://registry.npmjs.org
       # --ignore-scripts: no dependency lifecycle code runs while an OIDC
@@ -658,7 +658,7 @@ jobs:
           echo "Annotating from ${actual}, which Validate passed on."
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: 24
+          node-version-file: .nvmrc
 
       # A LOST UPDATE IS POSSIBLE HERE, AND IS ACCEPTED (Copilot review, #133).
       # A pull request body is replaced whole: GitHub offers no field-level

.github/workflows/release-cli.yml

@@ -78,7 +78,7 @@ jobs:
           persist-credentials: false # no git writes here; don't leave the token in git config
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: 24
+          node-version-file: .nvmrc
       - id: check
         run: |
           name=$(node -p "require('./packages/cli/package.json').name")
@@ -126,7 +126,7 @@ jobs:
       # so the OIDC exchange below is the only credential this job ever holds.
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: 24
+          node-version-file: .nvmrc
           cache: pnpm
           registry-url: https://registry.npmjs.org
       - run: pnpm install --frozen-lockfile --ignore-scripts

.github/workflows/release-vale.yml

@@ -150,7 +150,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: 24
+          node-version-file: .nvmrc
 
       # No install step: the script is zero-dependency CommonJS. GITHUB_TOKEN is
       # passed only to raise the GitHub API rate limit; the endpoints are public.
@@ -238,7 +238,7 @@ jobs:
           persist-credentials: false
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: 24
+          node-version-file: .nvmrc
       # --force on dispatch: an explicit human request publishes even when the
       # pinned version is already out. Only the automatic push path is gated.
       - id: gate
@@ -264,7 +264,7 @@ jobs:
           persist-credentials: false # nothing here writes to git
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: 24
+          node-version-file: .nvmrc
 
       # No dependency install at all: the script is zero-dependency CommonJS and
       # unpacks with `tar` and `unzip`, both present on ubuntu-latest. Nothing
@@ -335,6 +335,10 @@ jobs:
       # explains why (`always-auth` in .npmrc until v6.1, a dummy
       # NODE_AUTH_TOKEN in env until v7). The warning in issue #294 came from
       # this step's .npmrc under v4.4.0.
+      #
+      # A literal major rather than `node-version-file: .nvmrc`, because there
+      # is no checkout here for the file to be read from. Keep it equal to
+      # .nvmrc; this is the one place in the workflows the number is repeated.
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 24

.github/workflows/update-badges.yml

@@ -90,7 +90,7 @@ jobs:
 
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: 24
+          node-version-file: .nvmrc
 
       # No install step: the scripts are zero-dependency CommonJS. GITHUB_TOKEN
       # is passed only to raise the GitHub API rate limit on the Vale release

.github/workflows/validate.yml

@@ -51,7 +51,7 @@ jobs:
       - name: Setup Node
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: 24
+          node-version-file: .nvmrc
 
       - name: Install dependencies
         run: pnpm install --frozen-lockfile

.nvmrc

@@ -0,0 +1 @@
+24