build: require Node.js 22+ in BitGoWASM

.github/scripts/detect-changes.mjs

@@ -3,9 +3,12 @@ import { execSync } from "child_process";
 import { appendFileSync } from "fs";
 
 // Per-package matrix entries. Each object becomes one `matrix.include`
-// combination in the `test` job. The flags gate steps there:
+// combination in the `test` job, and each package fans out across the supported
+// Node versions. The flags gate steps there:
 //   - needs-wasm-pack:      download the build artifact (wasm .js/.wasm)
 //   - has-wasm-pack-tests:  run `npm run test:wasm-pack-{node,chrome}`
+//   - experimental:         allow the Current release line to fail without
+//                           blocking the workflow
 // Keeping the flags here (instead of a static `include:` block in the
 // workflow) is what actually lets `detect-changes` shrink the matrix — a
 // workflow `include:` entry whose `package` conflicts with the base matrix
@@ -21,8 +24,23 @@ const PACKAGE_CONFIG = [
   { package: "wasm-privacy-coin", "needs-wasm-pack": false, "has-wasm-pack-tests": false },
 ];
 
+const NODE_MATRIX = [
+  { "node-version": "22.x", experimental: false },
+  { "node-version": "24.x", experimental: false },
+  { "node-version": "26.x", experimental: true },
+];
+
 const ALL_PACKAGES = PACKAGE_CONFIG.map((p) => p.package);
 
+function expand(entries) {
+  return entries.flatMap((entry) =>
+    NODE_MATRIX.map((node) => ({
+      ...entry,
+      ...node,
+    })),
+  );
+}
+
 function setOutput(entries) {
   const value = JSON.stringify(entries);
   appendFileSync(process.env.GITHUB_OUTPUT, `packages=${value}\n`);
@@ -36,7 +54,7 @@ function entriesFor(pkgs) {
 
 // Non-PR events (push to master, workflow_dispatch): run everything
 if (process.env.GITHUB_EVENT_NAME !== "pull_request") {
-  setOutput(PACKAGE_CONFIG);
+  setOutput(expand(PACKAGE_CONFIG));
   process.exit(0);
 }
 
@@ -54,12 +72,12 @@ const sharedChanged = changedFiles.some((f) =>
   /^(\.github\/|package\.json$|lerna\.json$|package-lock\.json$)/.test(f),
 );
 if (sharedChanged) {
-  setOutput(PACKAGE_CONFIG);
+  setOutput(expand(PACKAGE_CONFIG));
   process.exit(0);
 }
 
 // Per-package detection; fall back to all if nothing package-specific changed
 const changed = ALL_PACKAGES.filter((pkg) =>
   changedFiles.some((f) => f.startsWith(`packages/${pkg}/`)),
 );
-setOutput(changed.length > 0 ? entriesFor(changed) : PACKAGE_CONFIG);
+setOutput(expand(changed.length > 0 ? entriesFor(changed) : PACKAGE_CONFIG));

.github/workflows/build-and-test.yaml

@@ -14,7 +14,6 @@
 
 env:
   RUST_TOOLCHAIN: nightly-2025-10-23
-  NODE_VERSION: 20
   NPM_VERSION: 11.5.1
   WASM_PACK_VERSION: 0.14.0
   WASM_OPT_VERSION: 0.116.1
@@ -70,7 +69,7 @@
       - name: Setup Node
         uses: actions/setup-node@v4
         with:
-          node-version: ${{ env.NODE_VERSION }}
+          node-version-file: .nvmrc
 
       - name: Install npm and wasm tools
         run: |
@@ -149,102 +148,98 @@
           path: packages/webui/dist
 
   test:
-    name: "Test ${{ matrix.package }}"
+    name: "Test ${{ matrix.package }} @ node ${{ matrix.node-version }}"
     needs: [detect-changes, build]
     runs-on: ubuntu-latest
+    continue-on-error: ${{ matrix.experimental }}
     strategy:
       fail-fast: false
       matrix:
-        # `detect-changes` emits an array of objects
-        # [{package, needs-wasm-pack, has-wasm-pack-tests}, ...] filtered to
-        # changed packages. Using `include:` here (not a static list keyed on
-        # `package`) is what makes the matrix actually shrink: a workflow
-        # `include:` entry whose `package` conflicts with the base matrix
-        # spawns a NEW job instead of being filtered, which previously
-        # re-added every package on every PR.
+        # `detect-changes` emits an array of objects with package + node-version.
+        # Each object becomes one matrix row.
         include: ${{ fromJson(needs.detect-changes.outputs.packages) }}
     steps:
       - uses: actions/checkout@v4
         with:
           ref: ${{ github.event.pull_request.head.sha || github.sha }}
           fetch-depth: 0
 
       - name: Install Rust
         uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1
         with:
           toolchain: ${{ env.RUST_TOOLCHAIN }}
           components: rustfmt, clippy
 
       - name: Cache Rust dependencies
         uses: Swatinem/rust-cache@f13886b937689c021905a6b90929199931d60db1 # v2.8.1
         with:
           workspaces: packages/${{ matrix.package }}
           cache-on-failure: true
 
       - name: Setup Node
         uses: actions/setup-node@v4
         with:
-          node-version: ${{ env.NODE_VERSION }}
+          node-version: ${{ matrix.node-version }}
 
       - name: Install npm
         run: npm install -g npm@${{ env.NPM_VERSION }}
 
       - name: Install wasm-pack
         if: matrix.needs-wasm-pack
         run: cargo install wasm-pack --version ${{ env.WASM_PACK_VERSION }}
 
       - name: Install Packages
         run: npm ci --workspaces --include-workspace-root
 
       - name: Download build artifacts
         uses: actions/download-artifact@v4
         with:
           name: build-output
           path: packages/
 
       - name: Lint
         run: npm run lint
         working-directory: packages/${{ matrix.package }}
 
       - name: Cargo Test
         run: cargo test --workspace
         working-directory: packages/${{ matrix.package }}
 
       - name: Cache Maven dependencies
         if: matrix.package == 'wasm-privacy-coin'
         uses: actions/cache@v4
         with:
           path: ~/.m2/repository
           key: ${{ runner.os }}-maven-${{ hashFiles('packages/wasm-privacy-coin/pom.xml') }}
           restore-keys: ${{ runner.os }}-maven-
 
       - name: Setup JDK 17 (wasm-privacy-coin Java tests)
         if: matrix.package == 'wasm-privacy-coin'
         uses: actions/setup-java@v4
         with:
           distribution: corretto
           java-version: "17"
 
       - name: Java Test
         if: matrix.package == 'wasm-privacy-coin'
         working-directory: packages/wasm-privacy-coin
         run: make test-java
 
       - name: Wasm-Pack Test (Node)
         if: matrix.has-wasm-pack-tests
         run: npm run test:wasm-pack-node
         working-directory: packages/${{ matrix.package }}
 
       - name: Wasm-Pack Test (Chrome)
         if: matrix.has-wasm-pack-tests
         run: npm run test:wasm-pack-chrome
         working-directory: packages/${{ matrix.package }}
 
       - name: Unit Test
         run: npm test
         working-directory: packages/${{ matrix.package }}
 
   finalize:
     name: "Finalize"
     needs: test
     runs-on: ubuntu-latest
@@ -257,7 +252,7 @@
       - name: Setup Node
         uses: actions/setup-node@v4
         with:
-          node-version: ${{ env.NODE_VERSION }}
+          node-version-file: .nvmrc
 
       - name: Install npm
         run: npm install -g npm@${{ env.NPM_VERSION }}
@@ -335,6 +330,7 @@
 
   # This job provides a stable "test / Test" status check for branch protection.
   # It runs after all other jobs complete successfully.
+
   gate:
     name: "Test"
     needs: [build, test, finalize]

.github/workflows/publish.yaml

@@ -70,7 +70,7 @@ jobs:
       - name: Setup Node
         uses: actions/setup-node@v4
         with:
-          node-version: 24.11.0
+          node-version-file: .nvmrc
           registry-url: https://registry.npmjs.org
 
       - name: Ensure npm 11.5.1

.nvmrc

@@ -1,2 +1,2 @@
-24.11.0
+24.22.1