ci: harden Sheets release workflows

[karlwaldman]

Summary

• disable persisted checkout credentials in validation, Pages, and protected Apps Script release jobs
• update the remaining Pages actions to their official Node 24 majors
• require dependency audit directly in the Pages validation job
• parse workflow YAML in the regression test so comments/unrelated text cannot satisfy release controls

Red-green proof

• RED: node --test test/public-claims.test.js -> 8 passed, 1 failed (persist-credentials missing)
• GREEN: targeted 9/9; full validate 98/98
• clean npm ci; npm audit --audit-level=moderate -> 0
• clasp 3.3.0; package/assets/portfolio/public claims/secret scans green
• four Apps Script runtime file SHA-256 values are byte-identical to main

Production evidence

Current main Pages run 31495600126 is green but emits the GitHub Node 20 deprecation annotation for configure-pages@v4, deploy-pages@v4, and upload-artifact@v4 (via upload-pages-artifact@v3). The selected official releases are configure-pages@v6, upload-pages-artifact@v5, and deploy-pages@v5. A post-merge Pages run must be green with the annotation absent.

No Apps Script version, Marketplace draft, public listing, or runtime source is changed by this PR. Sheets v13 remains held for the explicit API v2 production-green signal.

Summary by CodeRabbit

• Security

  • Strengthened automated workflows by preventing unnecessary credential persistence during builds, validation, and releases.
  • Added automated checks to identify moderate-or-higher dependency vulnerabilities.

• Reliability

  • Updated publishing workflows to use newer GitHub Pages tooling and current runtime support.

• Testing

  • Expanded workflow validation to verify secure permissions, dependency auditing, runtime configuration, and deployment requirements.

[coderabbitai]

Warning

Review limit reached

@karlwaldman, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 54 minutes

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 9142637c-08e8-48ce-82ef-2522ceb2142e

📥 Commits

Reviewing files that changed from the base of the PR and between 3b39984 and f407368.

📒 Files selected for processing (1)

• test/public-claims.test.js

📝 Walkthrough

Walkthrough

The workflows disable persisted checkout credentials. GitHub Pages adds moderate-severity dependency auditing and updates deployment actions. The test suite parses all three hosted workflows and validates their security and deployment settings.

Changes

Workflow security and validation

Layer / File(s)	Summary
Harden workflow execution .github/workflows/apps-script-release.yml, .github/workflows/validate.yml, .github/workflows/github-pages.yml	Hosted workflows disable persisted checkout credentials. GitHub Pages adds npm audit --audit-level=moderate and updates its deployment actions.
Validate workflow configuration package.json, test/public-claims.test.js	The project adds the yaml development dependency. Tests parse all three workflows and verify permissions, action versions, Node 24, checkout settings, auditing, and Pages deployment actions.

Estimated code review effort: 2 (Simple) | ~15 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: hardening the Sheets release workflows and related CI controls.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/sheets-node24-actions

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@test/public-claims.test.js`:
- Around line 147-172: Update the workflow assertions to inspect the expected
job rather than flattened steps for job-specific requirements. Require every
checkout and setup-node step to use the specified v6 and v6 actions, select the
appropriate validation job before asserting the npm audit command, and scope
GitHub Pages action checks to document.jobs.deploy.steps while asserting the
exact required action versions so legacy actions cannot pass.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: fb5dc6d3-1a3d-4697-a9cb-ef89063559ff

📥 Commits

Reviewing files that changed from the base of the PR and between 9542ae1 and 3b39984.

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (5)

• .github/workflows/apps-script-release.yml
• .github/workflows/github-pages.yml
• .github/workflows/validate.yml
• package.json
• test/public-claims.test.js