Set up pinned Node in Rust CI jobs and drop unused tsjs deps

.claude/commands/check-ci.md

@@ -7,5 +7,6 @@ Run all CI checks locally, in order. Stop and report if any step fails.
 5. `cd crates/trusted-server-js/lib && npx vitest run`
 6. `cd crates/trusted-server-js/lib && npm run format`
 7. `cd docs && npm run format`
+8. `node --test scripts/check-ci-node-pin.test.mjs && node scripts/check-ci-node-pin.mjs`
 
 Report a summary of all results when done.

.github/actions/setup-integration-test-env/action.yml

@@ -44,6 +44,18 @@ runs:
       shell: bash
       run: echo "node-version=$(grep '^nodejs ' .tool-versions | awk '{print $2}')" >> "$GITHUB_OUTPUT"
 
+    # Pin Node before anything compiles trusted-server-core: its dependency on
+    # trusted-server-js runs the TSJS build with the `npm` on PATH. That covers
+    # the Rust builds below and the callers' later cargo steps, and callers use
+    # this Node directly too (e.g. `npm install -g wrangler`), so keep the step
+    # unconditional.
+    - name: Use Node.js for the TSJS build
+      uses: actions/setup-node@v4
+      with:
+        node-version: ${{ steps.node-version.outputs.node-version }}
+        cache: npm
+        cache-dependency-path: crates/trusted-server-js/lib/package-lock.json
+
     - name: Retrieve Viceroy version
       id: viceroy-version
       if: ${{ inputs.install-viceroy == 'true' }}

.github/workflows/format.yml

@@ -39,6 +39,30 @@ jobs:
             exit 1
           fi
 
+  check-ci-node-pin:
+    name: CI Node pin guard
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      # The guard's tests check the tree before the guard landed; fetch only
+      # that commit instead of the full history.
+      - name: Fetch the pre-guard commit
+        run: git fetch --no-tags --depth=1 origin 7a0ecb4cbfa39af3d83f7e1ed2733d7eabdc4cb1
+
+      - name: Use Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version-file: .tool-versions
+
+      - name: Test the guard
+        run: node --test scripts/check-ci-node-pin.test.mjs
+
+      # Every job that compiles trusted-server-core also runs the TSJS build, so
+      # it must set up the `.tool-versions` Node first (see issue #1204).
+      - name: Verify jobs pin Node before compiling Rust
+        run: node scripts/check-ci-node-pin.mjs
+
   format-rust:
     name: cargo fmt
     runs-on: ubuntu-latest
@@ -58,6 +82,15 @@ jobs:
           components: "clippy, rustfmt"
           cache-shared-key: cargo-${{ runner.os }}
 
+      # trusted-server-core's dependency on trusted-server-js runs the TSJS
+      # build with the `npm` on PATH, so pin Node before any cargo step.
+      - name: Use Node.js for the TSJS build
+        uses: actions/setup-node@v4
+        with:
+          node-version-file: .tool-versions
+          cache: npm
+          cache-dependency-path: crates/trusted-server-js/lib/package-lock.json
+
       - name: Run cargo fmt
         uses: actions-rust-lang/rustfmt@v1
 

.github/workflows/integration-tests.yml

@@ -90,11 +90,6 @@ jobs:
       - name: Load integration test Docker images
         run: docker load --input "$DOCKER_ARTIFACT_PATH"
 
-      - name: Set up Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: ${{ steps.shared-setup.outputs.node-version }}
-
       - name: Install wrangler
         run: npm install -g wrangler
 

.github/workflows/test.yml

@@ -51,7 +51,9 @@ jobs:
         if: steps.cache-viceroy.outputs.cache-hit != 'true'
         run: cargo install viceroy --version "${{ steps.viceroy-version.outputs.viceroy-version }}" --locked --force
 
-      - name: Use Node.js for the served-seam contract
+      # trusted-server-core's dependency on trusted-server-js runs the TSJS
+      # build with the `npm` on PATH, so pin Node before any cargo step.
+      - name: Use Node.js for the TSJS build and the served-seam contract
         uses: actions/setup-node@v4
         with:
           node-version: ${{ steps.node-version.outputs.node-version }}
@@ -91,12 +93,15 @@ jobs:
           target: wasm32-wasip1
           cache-shared-key: cargo-${{ runner.os }}
 
-      - name: Read pinned Node.js version for CLI fixtures
+      - name: Read pinned Node.js version
         id: node-version
         shell: bash
         run: echo "version=$(awk '$1 == "nodejs" { print $2 }' .tool-versions)" >> "$GITHUB_OUTPUT"
 
-      - uses: actions/setup-node@v4
+      # trusted-server-core's dependency on trusted-server-js runs the TSJS
+      # build with the `npm` on PATH, so pin Node before any cargo step.
+      - name: Use Node.js for the TSJS build and the CLI fixtures
+        uses: actions/setup-node@v4
         with:
           node-version: ${{ steps.node-version.outputs.version }}
 
@@ -143,6 +148,15 @@ jobs:
           target: wasm32-unknown-unknown
           cache-shared-key: cargo-${{ runner.os }}
 
+      # trusted-server-core's dependency on trusted-server-js runs the TSJS
+      # build with the `npm` on PATH, so pin Node before any cargo step.
+      - name: Use Node.js for the TSJS build
+        uses: actions/setup-node@v4
+        with:
+          node-version-file: .tool-versions
+          cache: npm
+          cache-dependency-path: crates/trusted-server-js/lib/package-lock.json
+
       - name: Check Cloudflare adapter (native host)
         run: cargo check -p trusted-server-adapter-cloudflare
 
@@ -170,6 +184,15 @@ jobs:
           target: wasm32-wasip1
           cache-shared-key: cargo-${{ runner.os }}
 
+      # trusted-server-core's dependency on trusted-server-js runs the TSJS
+      # build with the `npm` on PATH, so pin Node before any cargo step.
+      - name: Use Node.js for the TSJS build
+        uses: actions/setup-node@v4
+        with:
+          node-version-file: .tool-versions
+          cache: npm
+          cache-dependency-path: crates/trusted-server-js/lib/package-lock.json
+
       - name: Check Spin adapter (native host)
         run: cargo check -p trusted-server-adapter-spin
 
@@ -209,6 +232,15 @@ jobs:
           components: clippy, rustfmt
           cache-shared-key: cargo-${{ runner.os }}
 
+      # trusted-server-core's dependency on trusted-server-js runs the TSJS
+      # build with the `npm` on PATH, so pin Node before any cargo step.
+      - name: Use Node.js for the TSJS build
+        uses: actions/setup-node@v4
+        with:
+          node-version-file: .tool-versions
+          cache: npm
+          cache-dependency-path: crates/trusted-server-js/lib/package-lock.json
+
       - name: Format check (parity test crate)
         run: cargo fmt --manifest-path crates/trusted-server-integration-tests/Cargo.toml -- --check
 
@@ -240,12 +272,15 @@ jobs:
           components: "clippy, rustfmt"
           cache-shared-key: cargo-cli-${{ runner.os }}
 
-      - name: Read pinned Node.js version for CLI fixtures
+      - name: Read pinned Node.js version
         id: node-version
         shell: bash
         run: echo "version=$(awk '$1 == "nodejs" { print $2 }' .tool-versions)" >> "$GITHUB_OUTPUT"
 
-      - uses: actions/setup-node@v4
+      # trusted-server-core's dependency on trusted-server-js runs the TSJS
+      # build with the `npm` on PATH, so pin Node before any cargo step.
+      - name: Use Node.js for the TSJS build and the CLI fixtures
+        uses: actions/setup-node@v4
         with:
           node-version: ${{ steps.node-version.outputs.version }}
 

AGENTS.md

@@ -364,6 +364,7 @@ Every PR must pass:
 8. Markdown format outside `docs/` (requires `cd docs && npm ci` first): `docs/node_modules/.bin/prettier --config docs/.prettierrc --check "*.md" ".claude/**/*.md" ".github/**/*.md" "crates/**/*.md" "scripts/**/*.md" "tinybird/**/*.md"`; fix with `--write` in place of `--check`
 9. Native core build-digest test and lint (`cargo test -p trusted-server-core --test template_build_digest` and `cargo clippy -p trusted-server-core --test template_build_digest -- -D warnings`)
 10. Wasm clock lint: `scripts/lint-wasm-clock.sh` (crates built into the Cloudflare Worker must use `web_time`, not the `std::time::{Instant,SystemTime}` `now`/`elapsed` methods, which panic there)
+11. CI Node pin guard: `node --test scripts/check-ci-node-pin.test.mjs && node scripts/check-ci-node-pin.mjs` with the `.tool-versions` Node (every CI job that compiles Rust sets up the `.tool-versions` Node before its first cargo step)
 
 ---
 

crates/trusted-server-adapter-cloudflare/Cargo.toml

@@ -31,7 +31,6 @@ futures = { workspace = true }
 log = { workspace = true }
 serde_json = { workspace = true }
 trusted-server-core = { workspace = true }
-trusted-server-js = { workspace = true }
 worker = { workspace = true, optional = true }
 
 [target.'cfg(target_arch = "wasm32")'.dependencies]

crates/trusted-server-adapter-spin/Cargo.toml

@@ -32,7 +32,6 @@ futures = { workspace = true }
 http-body-util = { workspace = true }
 log = { workspace = true }
 trusted-server-core = { workspace = true }
-trusted-server-js = { workspace = true }
 
 [target.'cfg(target_arch = "wasm32")'.dependencies]
 spin-sdk = { workspace = true }

scripts/README.md

@@ -7,6 +7,7 @@ their documented orchestration handles a probe deliberately.
 | ----------------------------------------- | ------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | `batch-sync.sh`                           | Endpoint, bearer token, EC ID, partner UID; `curl` and Python      | Sends one authenticated batch-sync request. Its temporary response file is removed on exit.                                                                               |
 | `benchmark.sh`                            | A running server; `curl`, `bc`, and optionally `hey`               | May install `hey` through Homebrew. `--save` writes under `benchmark-results/`; it does not stop the server.                                                              |
+| `check-ci-node-pin.mjs`                   | Pinned Node; tests in `check-ci-node-pin.test.mjs`                 | Read-only. Fails when a CI job compiles Rust before an unconditional `actions/setup-node` step pinned to `.tool-versions`; `--root` checks another checkout.              |
 | `profile.sh`                              | Fastly CLI, Rust WASM target, `curl`; endpoint and request options | Builds and starts the Fastly app, stops the owned process, and retains a profile under `benchmark-results/profiles/`. `--open` launches the local viewer.                 |
 | `generate-integration-viceroy-configs.sh` | Rust toolchain; optional origin port and artifact directory        | Builds the native generator and writes Viceroy config under `target/integration-test-artifacts/`; generated files persist.                                                |
 | `integration-tests.sh`                    | Docker, Viceroy, Rust WASM target, pinned Node                     | Builds WASM/native artifacts and two Docker images, generates Viceroy config, and runs native integration tests serially. Build products and images persist.              |