[mldangelo-oai]

Summary

The mutation job selected Node twice: once to set the version, then again to restore the pnpm cache. The shared setup can do both in one invocation.

Changes

• Give the shared setup a Node version input defaulting to the existing 22.13.0 floor. The mutation trial supplies its existing 24.15.0 requirement.
• Remove the earlier setup step and the boolean that made the second invocation depend on the first. The pnpm action, dependency cache, lockfile, Bun version and mutation command stay the same.

Testing

• Resolved all 14 workflow job definitions using the shared action: the mutation job selects 24.15.0 and the other 13 select 22.13.0. Architecture, compile conditions, and cache paths matched before and after.
• Ran the frozen SDK install and the full three-module Stryker trial on Node 24.15.0 and Bun 1.3.14. All 482 mutation identities and results matched the successful hosted trial: 286 killed, 196 survived, no errors or timeouts.
• Replayed the pinned pnpm and setup-node actions for both versions. The pnpm binary, cache key and cache version matched at the same path. The local cache service deliberately returned a miss.
• Passed 24 CI selection, source verification and release-guide tests, actionlint with ShellCheck, configured zizmor, and git diff --check.

Risk and rollout

This affects the internal CI composite. Its pnpm installer now starts from the hosted runner's initial npm in the mutation job, as it does in the other jobs; dependency installation and Stryker still use the exact chosen Node version. The workflow removes one action invocation. Elapsed-time savings have not been measured. The next scheduled mutation run will exercise the changed order on GitHub.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-25T11:30:30.285546Z	f89b857	PR opened
🔒 Security Review	✅ Completed 2026-10-25T11:30:57.856510Z	f89b857	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[alandelong-oai]

Thanks for simplifying the runtime setup. This owner-level merge-safety pass found no blocking issues: all 14 resolved callers preserve their Node version, architecture, compilation condition, and cache paths, while the mutation job now selects Node 24.15.0 once.

Verified the frozen install and full three-module mutation trial on Node 24.15.0/Bun 1.3.14 (482 mutants: 286 killed, 196 survived, no errors or timeouts), all 24 CI selection/source/release-guide tests, configured actionlint/ShellCheck and zizmor, and diff checks. Hosted cache restoration and runner timing were not exercised locally.