2026-09-09, Version 26.8.2 (Current)

.github/workflows/auto-start-ci.yml

@@ -9,7 +9,7 @@ on:
     # optimistic, it can take longer to run.
     # To understand why `schedule` is used instead of other events, refer to
     # ./doc/contributing/commit-queue.md
-    - cron: '*/5 * * * *'
+    - cron: 3/5 * * * *
 
 concurrency: ${{ github.workflow }}
 
@@ -51,7 +51,7 @@ jobs:
     runs-on: ubuntu-slim
     steps:
       - name: Install Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
         with:
           node-version: ${{ env.NODE_VERSION }}
 

.github/workflows/benchmark.yml

@@ -78,7 +78,7 @@ jobs:
     name: '${{ matrix.system }}: with shared libraries'
     runs-on: ${{ matrix.runner }}
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           repository: ${{ inputs.repo || github.repository }}
           ref: refs/pull/${{ inputs.pr_id }}/merge
@@ -92,7 +92,7 @@ jobs:
         env:
           EXPECTED_SHA: ${{ inputs.commit }}
 
-      - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342  # v31.11.0
+      - uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24  # v31.11.1
         with:
           extra_nix_config: sandbox = true
 
@@ -195,7 +195,7 @@ jobs:
       contents: read
       pull-requests: write
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
           sparse-checkout: |
@@ -211,7 +211,7 @@ jobs:
           merge-multiple: true
           path: raw-results
 
-      - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342  # v31.11.0
+      - uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24  # v31.11.1
         with:
           extra_nix_config: sandbox = true
 

.github/workflows/build-shared.yml

@@ -53,7 +53,7 @@ jobs:
           tar xzf tarballs/*.tar.gz -C "$RUNNER_TEMP"
           echo "TAR_DIR=$RUNNER_TEMP/$(basename tarballs/*.tar.gz .tar.gz)" >> "$GITHUB_ENV"
 
-      - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342  # v31.11.0
+      - uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24  # v31.11.1
         with:
           extra_nix_config: sandbox = true
 

.github/workflows/build-tarball.yml

@@ -76,7 +76,7 @@ jobs:
     if: github.event.pull_request.draft == false
     runs-on: ubuntu-slim
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
       - name: Set up Python ${{ env.PYTHON_VERSION }}
@@ -104,7 +104,7 @@ jobs:
       SCCACHE_GHA_ENABLED: ${{ github.base_ref == 'main' || github.ref_name == 'main' }}
       SCCACHE_IDLE_TIMEOUT: '0'
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
           sparse-checkout: .github/actions/install-clang

.github/workflows/codeql.yml

@@ -24,19 +24,19 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81  # v4.37.3
+        uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938  # v4.37.9
         with:
           languages: ${{ matrix.language }}
           config-file: ./.github/codeql-config.yml
 
       - name: Autobuild
-        uses: github/codeql-action/autobuild@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81  # v4.37.3
+        uses: github/codeql-action/autobuild@cdf488f595d80d6e07e03d4674febd5ab45fa938  # v4.37.9
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81  # v4.37.3
+        uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938  # v4.37.9
         with:
           category: /language:${{matrix.language}}

.github/workflows/commit-lint.yml

@@ -20,13 +20,13 @@ jobs:
         run: |
           echo "plusOne=$((${{ github.event.pull_request.commits }} + 1))" >> $GITHUB_OUTPUT
           echo "minusOne=$((${{ github.event.pull_request.commits }} - 1))" >> $GITHUB_OUTPUT
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           fetch-depth: ${{ steps.nb-of-commits.outputs.plusOne }}
           persist-credentials: false
       - run: git reset HEAD^2
       - name: Install Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
         with:
           node-version: ${{ env.NODE_VERSION }}
       - name: Validate commit message

.github/workflows/commit-queue.yml

@@ -11,7 +11,7 @@ on:
   # be read-only, and the Action won't have access to any other repository
   # secrets, which it needs to access Jenkins API.
   schedule:
-    - cron: '*/5 * * * *'
+    - cron: 3/5 * * * *
 
 concurrency: ${{ github.workflow }}
 
@@ -28,6 +28,7 @@ jobs:
     if: github.repository == 'nodejs/node'
     runs-on: ubuntu-slim
     outputs:
+      aged_prs: ${{ steps.get_candidate_prs.outputs.aged_prs }}
       candidates: ${{ steps.get_candidate_prs.outputs.candidates }}
     steps:
       - name: Get Pull Request Candidates
@@ -50,6 +51,7 @@ jobs:
                   --search "-label:blocked")
           candidates=$(printf '%s %s\n' "$fast_track_prs" "$aged_prs" |
                   jq -r -s 'reduce .[] as $pr ([]; if index($pr) then . else . + [$pr] end) | join(" ")')
+          echo "aged_prs=$aged_prs" >> "$GITHUB_OUTPUT"
           echo "candidates=$candidates" >> "$GITHUB_OUTPUT"
         env:
           GH_TOKEN: ${{ github.token }}
@@ -64,7 +66,7 @@ jobs:
     runs-on: ubuntu-slim
     steps:
       - name: Install Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
         with:
           node-version: ${{ env.NODE_VERSION }}
 
@@ -93,6 +95,7 @@ jobs:
           curl -fsSLo "$readme" "https://github.com/${GITHUB_REPOSITORY}/raw/${GITHUB_SHA}/README.md"
 
           numbers=
+          lacks_second_approval_prs=
           # shellcheck disable=SC2086
           for pr in $CANDIDATES; do
             metadata="${RUNNER_TEMP}/metadata-${pr}.json"
@@ -139,6 +142,14 @@ jobs:
             if [ "$metadata_status" -ge 20 ] && [ "$metadata_status" -le 29 ]; then
               echo "pr ${pr} skipped, not ready to land"
               echo "reason codes: ${metadata_reason_codes}"
+              if jq -e '
+                    (.reasonCodes | index("wait-time")) and
+                    (.pullRequest.labels | index("lacks-second-approval") | not)
+                  ' "$metadata" > /dev/null; then
+                case " $AGED_PRS " in
+                  *" $pr "*) lacks_second_approval_prs="$lacks_second_approval_prs $pr" ;;
+                esac
+              fi
               continue
             fi
 
@@ -148,12 +159,28 @@ jobs:
           done
 
           numbers=$(echo "$numbers" | xargs)
+          lacks_second_approval_prs=$(echo "$lacks_second_approval_prs" | xargs)
           echo "numbers=$numbers" >> "$GITHUB_OUTPUT"
+          echo "lacks_second_approval_prs=$lacks_second_approval_prs" >> "$GITHUB_OUTPUT"
         env:
+          AGED_PRS: ${{ needs.get_candidate_prs.outputs.aged_prs }}
           CANDIDATES: ${{ needs.get_candidate_prs.outputs.candidates }}
           GH_TOKEN: ${{ github.token }}
 
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - name: Label Pull Requests Lacking a Second Approval
+        if: steps.get_mergeable_prs.outputs.lacks_second_approval_prs != ''
+        run: |
+          # shellcheck disable=SC2086
+          for pr in $PULL_REQUESTS; do
+            if ! gh -R "$GITHUB_REPOSITORY" pr edit "$pr" --add-label 'lacks-second-approval'; then
+              echo "::warning::Failed to add lacks-second-approval to PR ${pr}"
+            fi
+          done
+        env:
+          GH_TOKEN: ${{ secrets.GH_USER_TOKEN }}
+          PULL_REQUESTS: ${{ steps.get_mergeable_prs.outputs.lacks_second_approval_prs }}
+
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         if: steps.get_mergeable_prs.outputs.numbers != ''
         with:
           # A personal token is required because pushing with GITHUB_TOKEN will

.github/workflows/contributor-guidance.yml

@@ -0,0 +1,147 @@
+name: Contributor guidance
+
+on:
+  pull_request_target:
+    types: [opened]
+
+permissions: {}
+
+jobs:
+  contributor:
+    name: Resolve contributor status
+    # Use the event only to exclude trusted associations, mannequins, and bots.
+    # Resolve every potentially external contributor with a privileged API request.
+    if: >-
+      github.run_attempt == 1 &&
+      github.repository == 'nodejs/node' &&
+      github.event.pull_request.user.type != 'Bot' &&
+      (github.event.pull_request.author_association == 'CONTRIBUTOR' ||
+      github.event.pull_request.author_association == 'FIRST_TIMER' ||
+      github.event.pull_request.author_association == 'FIRST_TIME_CONTRIBUTOR' ||
+      github.event.pull_request.author_association == 'NONE')
+    runs-on: ubuntu-slim
+    outputs:
+      is_first_time: ${{ steps.resolve.outputs.is_first_time }}
+      should_scan: ${{ steps.resolve.outputs.should_scan }}
+    steps:
+      - name: Check author association
+        id: resolve
+        env:
+          GH_TOKEN: ${{ secrets.GH_USER_TOKEN }}
+          NUMBER: ${{ github.event.pull_request.number }}
+        run: |
+          started_at=$SECONDS
+          # TODO: Remove the retries once privileged API requests are confirmed
+          # to return the association immediately.
+          for delay in 0 15 30 60; do
+            sleep "$delay"
+            association=$(gh api "/repos/$GITHUB_REPOSITORY/pulls/$NUMBER" \
+              --jq '.author_association')
+            elapsed=$((SECONDS - started_at))
+            echo "Author association after ${elapsed}s: $association"
+
+            case "$association" in
+              FIRST_TIMER|FIRST_TIME_CONTRIBUTOR)
+                echo 'is_first_time=true' >> "$GITHUB_OUTPUT"
+                echo 'should_scan=true' >> "$GITHUB_OUTPUT"
+                exit 0
+                ;;
+              CONTRIBUTOR)
+                echo 'is_first_time=false' >> "$GITHUB_OUTPUT"
+                echo 'should_scan=true' >> "$GITHUB_OUTPUT"
+                exit 0
+                ;;
+              NONE)
+                ;;
+              COLLABORATOR|MANNEQUIN|MEMBER|OWNER)
+                echo 'is_first_time=false' >> "$GITHUB_OUTPUT"
+                echo 'should_scan=false' >> "$GITHUB_OUTPUT"
+                exit 0
+                ;;
+              *)
+                echo "Unexpected author association: $association" >&2
+                exit 1
+                ;;
+            esac
+          done
+
+          # NONE is unresolved, not trusted. Scan without posting the welcome.
+          echo 'is_first_time=false' >> "$GITHUB_OUTPUT"
+          echo 'should_scan=true' >> "$GITHUB_OUTPUT"
+
+  guidance:
+    name: Apply contributor guidance
+    needs: contributor
+    if: needs.contributor.outputs.should_scan == 'true'
+    runs-on: ubuntu-slim
+    permissions:
+      contents: read
+      pull-requests: write
+    steps:
+      - name: Scan contributor activity
+        id: agentscan
+        # The welcome should still be posted if this advisory scan fails.
+        continue-on-error: true
+        uses: MatteoGabriele/agentscan-action@8112fb79b33fafb8506159df20129a34209ac410  # v2.5.0
+        with:
+          github-token: ${{ github.token }}
+          mode: labels
+          scan-pull-requests: true
+          scan-issues: false
+          auto-close: false
+          honeypot: false
+
+      - name: Comment with contributor guidance
+        env:
+          ADD_CAUTION: >-
+            ${{
+              steps.agentscan.outputs.classification == 'mixed' ||
+              steps.agentscan.outputs.classification == 'automation' ||
+              steps.agentscan.outputs['community-flagged'] == 'true'
+            }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          IS_FIRST_TIME: ${{ needs.contributor.outputs.is_first_time }}
+          NUMBER: ${{ github.event.pull_request.number }}
+          WELCOME_MESSAGE: >2-
+              Welcome to Node.js, and thank you for your first contribution!
+
+            Before review, please take a moment to read:
+
+              * the [guide for first-time contributors](https://github.com/nodejs/node/blob/HEAD/doc/contributing/first-contributions.md)
+              * the [contribution and automation policies](https://github.com/nodejs/node/blob/HEAD/CONTRIBUTING.md)
+              * the [pull request guide](https://github.com/nodejs/node/blob/HEAD/doc/contributing/pull-requests.md)
+              * the [AI use policy](https://github.com/nodejs/node/blob/HEAD/doc/contributing/ai-guidelines.md)
+              * the [Code of Conduct](https://github.com/nodejs/admin/blob/HEAD/CODE_OF_CONDUCT.md)
+
+            Please make sure every commit is
+            [signed off](https://github.com/nodejs/node/blob/HEAD/doc/contributing/pull-requests.md#step-4-commit).
+            For a first pull request, GitHub Actions require collaborator
+            approval and Jenkins CI must be started by a collaborator or triager,
+            so an initial wait is normal.
+          CAUTION_MESSAGE: >-
+            > [!CAUTION]
+
+            > AgentScan found account activity patterns that may be consistent with
+            automation. This is a heuristic, not proof that this pull request was
+            opened by an agent or violates policy. AI-assisted contributions are
+            permitted, but automated tooling must not open pull requests without
+            advance approval, and contributors must personally understand, test,
+            verify, and take responsibility for every submitted change. See the
+            [AgentScan analysis](https://agentscan.tools/user/${{ github.event.pull_request.user.login }}),
+            [AI use policy](https://github.com/nodejs/node/blob/HEAD/doc/contributing/ai-guidelines.md),
+            and
+            [automation policy](https://github.com/nodejs/node/blob/HEAD/CONTRIBUTING.md#automation-and-bots)
+            for additional context.
+        run: |
+          if [[ "$IS_FIRST_TIME" == "true" && "$ADD_CAUTION" == "true" ]]; then
+            body="$WELCOME_MESSAGE"$'\n\n'"$CAUTION_MESSAGE"
+          elif [[ "$IS_FIRST_TIME" == "true" ]]; then
+            body="$WELCOME_MESSAGE"
+          elif [[ "$ADD_CAUTION" == "true" ]]; then
+            body="$CAUTION_MESSAGE"
+          else
+            exit 0
+          fi
+
+          printf '%s\n' "$body" |
+            gh pr comment "$NUMBER" --repo "$GITHUB_REPOSITORY" --body-file -

.github/workflows/coverage-linux-without-intl.yml

@@ -50,7 +50,7 @@ jobs:
     if: github.event.pull_request.draft == false
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
       - name: Install Clang ${{ env.CLANG_VERSION }}

.github/workflows/coverage-linux.yml

@@ -50,7 +50,7 @@ jobs:
     if: github.event.pull_request.draft == false
     runs-on: ubuntu-24.04-arm
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
       - name: Install Clang ${{ env.CLANG_VERSION }}

.github/workflows/coverage-windows.yml

@@ -72,7 +72,7 @@ jobs:
     if: github.event.pull_request.draft == false
     runs-on: windows-2025
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
       - name: Set up Python ${{ env.PYTHON_VERSION }}

.github/workflows/create-release-proposal.yml

@@ -33,14 +33,14 @@ jobs:
       RELEASE_LINE: ${{ inputs.release-line }}
     runs-on: ubuntu-slim
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           ref: ${{ env.STAGING_BRANCH }}
           persist-credentials: false
 
       # Install dependencies
       - name: Install Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
         with:
           node-version: ${{ env.NODE_VERSION }}