ci: pin Node to the patch in .tool-versions, and stop pinning the URL parser's verdict on xn--

[ArloL]

What failed

CI run 33662723404 on main: test (latest-esr) went red in npm run test:coverage while test (latest) passed on the same commit.

FAIL test/matcher/matcher.test.ts > hostMatcher rejects non-hostnames, naming the value it rejected
AssertionError: expected [Function] to throw an error
 ❯ test/matcher/matcher.test.ts:83:39
    expect(() => hostMatcher("xn--")).toThrow('not a bare hostname: "xn--"');

Why

The two legs got different Node builds from the runner's tool cache (node-version: 24, check-latest: false):

Job	Node	ada	new URL("http://xn--/")
test (latest)	24.19.0	3.4.4	throws
test (latest-esr)	24.20.0	4.0.0	hostname xn--

Node 24.20.0 updated ada to 4.0.0, which passes an undecodable xn-- label through as a plain host. The assertion was pinning the URL parser's answer, not the matcher's: canonicalHost hands hostname validity to new URL deliberately and owns no IDNA rule of its own.

Changes

Pin Node to the patch. .tool-versions carries nodejs 24.20.0; all ten setup-node steps across the five workflows read it through node-version-file instead of spelling node-version: 24, so every job in a run builds on one version and a bump is one line. Renovate's asdf manager (on under config:recommended) keeps it current. asdf and mise pick the same file up locally.

Pin the pin. The AMO reviewer-notes case that derived "Node 24" from the workflows now takes the major from .tool-versions and asserts every setup-node step reads that file and none carries a node-version: of its own. Revert-verified: one workflow put back to node-version: 24 goes red. The notes name only the major, so a patch bump does not touch them.

Drop the parser-dependent assertion. The xn-- line goes, with a comment saying why only inputs every parser refuses belong in that block. The catch branch it documented stays covered by "" and "[". No source change: adding our own punycode check would make the matcher stricter than the browser whose URL it mirrors. The pin alone would not have been enough here, since 24.20.0 is the version being pinned.

README's build line now points at .tool-versions rather than "verified on 24".

Verified

• test/matcher/ green on Node 22.22.2, 24.19.0 and 24.20.0 (24.20.0 reproduced the failure before the change)
• npm run typecheck, npm run lint, npm run test:coverage (72 files, 1013 tests) green
• stryker run --mutate src/matcher/matcher.ts: 189/189 killed, score 100

🤖 Generated with Claude Code

https://claude.ai/code/session_01DhHZArj9LxcKUemN1EMVKt

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud