[claude]

Requested by Samuel Attard · Slack thread

The setup-node steps here ask for a floating Node version (22, read from .nvmrc), which setup-node satisfies from the runner's tool cache before checking for anything newer, so CI can keep running an older patch after a Node security release. Setting check-latest makes it resolve the newest matching release and only download when the cached copy is stale.

---

Generated by Claude Code

[claude]

I reviewed this PR and didn't find any bugs. The repository's CODEOWNERS file covers every path, including these workflows, so a code owner still needs to sign off.

What was reviewed:

• Both setup-node steps in lint.yml and test.yml now set check-latest: true next to node-version-file: .nvmrc, where .nvmrc holds the floating spec 22.
• These are the only setup-node steps in .github/workflows, so none was missed. The action SHA pin and the yarn install --immutable steps are unchanged.

Extended reasoning...

The change adds one line, check-latest: true, to the setup-node step in .github/workflows/lint.yml and in .github/workflows/test.yml. It touches CI configuration only: no application code and no security-sensitive surface such as auth, secrets or permissions. The change is small and correct. I deferred instead of approving because the catch-all * rule in .github/CODEOWNERS assigns these files to code owners, and approval guidelines rule out auto-approving paths that have a CODEOWNER.