chore(ado-script): bump default Node install to 22.x (#1036)

* fix(runtimes): replace deprecated NodeTool@0 with UseNode@1

Co-authored-by: jamesadevine <4742697+jamesadevine@users.noreply.github.com>

* docs: update NodeTool@0 references to UseNode@1

Co-authored-by: jamesadevine <4742697+jamesadevine@users.noreply.github.com>

* chore(ado-script): bump default Node install to 22.x

Co-authored-by: jamesadevine <4742697+jamesadevine@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: jamesadevine <4742697+jamesadevine@users.noreply.github.com>

Author: Copilot

docs/ado-script.md

@@ -251,7 +251,7 @@ GitHub-typed repos return before any SDK load.
        ┌──────────────────────┐
        │  Generated pipeline  │
        │  Setup job:          │
-       │   1. NodeTool@0      │
+       │   1. UseNode@1       │
        │   2. curl + sha256   │     downloads ado-script.zip
        │      + unzip         │     from the matching ado-aw release
        │   3. node gate/index │     reads GATE_SPEC env var
@@ -449,7 +449,7 @@ bundle**:
 When `filters:` lowers to non-empty checks, `AdoScriptExtension::declarations()`
 returns three typed `Declarations::setup_steps` entries for the Setup job:
 
-1. **`NodeTool@0`** — installs Node 20.x LTS, capped at
+1. **`UseNode@1`** — installs Node 22.x LTS, capped at
    `timeoutInMinutes: 5`.
 2. **`curl` download + verify + extract** — fetches `checksums.txt`
    and `ado-script.zip` from the `githubnext/ado-aw` release matching
@@ -467,7 +467,7 @@ PR contributor activates (`on.pr` configured and not disabled),
 `AdoScriptExtension::declarations()` returns the install + download pair in
 `Declarations::agent_prepare_steps` for the Agent job:
 
-1. **`NodeTool@0`** — same shape as above.
+1. **`UseNode@1`** — same shape as above.
 2. **`curl` download + verify + extract** — same artefact, same
    verification.
 3. **`bash: node '/tmp/ado-aw-scripts/ado-script/import.js'`** —
@@ -619,7 +619,7 @@ If a future bundle blows the budget:
   Node. Stage 3 keeps a Rust-only execution path.
 - Migrating the agent-stats parser. It runs in-pipeline as part of
   Stage 1 wrap-up and has no TypeScript dependency need.
-- Bundling Node itself. Pipelines install Node via `NodeTool@0`.
+- Bundling Node itself. Pipelines install Node via `UseNode@1`.
 
 ## See also
 

docs/filter-ir.md

@@ -364,7 +364,7 @@ runtime-import resolver — see [`runtime-imports.md`](runtime-imports.md).
 
 For the gate path it controls:
 
-1. **Node install step** — emits a `NodeTool@0` step pinned to Node 20.x
+1. **Node install step** — emits a `UseNode@1` step pinned to Node 22.x
    LTS so `gate.js` has a runtime.
 2. **Download step** — fetches `ado-script.zip` from the ado-aw release
    artifacts, verifies its SHA256 checksum via `checksums.txt`, then

docs/front-matter.md

@@ -49,7 +49,7 @@ runtimes:                      # optional runtime configuration (language enviro
   # python:                    # Alternative object format (pin version, configure internal feed)
   #   version: "3.12"
   #   feed-url: "https://pkgs.dev.azure.com/myorg/_packaging/myfeed/pypi/simple/"
-  # node: true                 # Node.js runtime — auto-installs via NodeTool@0 (see docs/runtimes.md)
+  # node: true                 # Node.js runtime — auto-installs via UseNode@1 (see docs/runtimes.md)
   # node:                      # Alternative object format (pin version, configure internal feed)
   #   version: "22.x"
   #   feed-url: "https://pkgs.dev.azure.com/ORG/PROJECT/_packaging/FEED/npm/registry/"

docs/ir.md

@@ -86,7 +86,7 @@ pub enum Step {
 Use the typed structs whenever the compiler owns the step:
 
 - `Step::Bash` for inline bash (`BashStep::script` is the raw body, not a YAML block).
-- `Step::Task` for ADO task invocations such as `NodeTool@0`, `UsePythonVersion@0`, or `UseDotNet@2`. For compiler-generated built-in tasks, prefer `src/compile/ir/tasks.rs` factory helpers over ad-hoc `TaskStep::new(...)` calls.
+- `Step::Task` for ADO task invocations such as `UseNode@1`, `UsePythonVersion@0`, or `UseDotNet@2`. For compiler-generated built-in tasks, prefer `src/compile/ir/tasks.rs` factory helpers over ad-hoc `TaskStep::new(...)` calls.
 - `Step::Checkout` for `checkout:` steps.
 - `Step::Download` for pipeline-artifact downloads.
 - `Step::Publish` for pipeline-artifact publishes. Under 1ES, lowering moves publish steps into `templateContext.outputs` so artifacts are published by the 1ES template machinery exactly once.

docs/runtime-imports.md

@@ -78,7 +78,7 @@ compile time instead of on the pipeline runner.
 - **Runtime**: `import.js` is ncc-bundled into `ado-script.zip`.
   The always-on `AdoScriptExtension` contributes three typed
   `Declarations::agent_prepare_steps` entries to the Agent job:
-  `NodeTool@0` install, the `ado-script.zip` download/verify/extract,
+  `UseNode@1` install, the `ado-script.zip` download/verify/extract,
   and the `node import.js` resolver invocation. All three run on the
   same VM as the agent — ADO jobs are VM-isolated, so the bundle must
   be downloaded inside whichever job consumes it.

docs/runtimes.md

@@ -71,7 +71,7 @@ When enabled, the compiler:
 
 ### Node.js (`node:`)
 
-Node.js runtime. Auto-installs Node.js via `NodeTool@0`, emits `npmAuthenticate@0` for internal feed access, adds Node ecosystem domains to the AWF network allowlist, extends the bash command allow-list, and optionally injects feed URL env vars for npm.
+Node.js runtime. Auto-installs Node.js via `UseNode@1`, emits `npmAuthenticate@0` for internal feed access, adds Node ecosystem domains to the AWF network allowlist, extends the bash command allow-list, and optionally injects feed URL env vars for npm.
 
 ```yaml
 # Simple enablement (installs default Node LTS)
@@ -89,18 +89,18 @@ runtimes:
 
 | Field | Type | Description |
 |-------|------|-------------|
-| `version` | string | Node.js version to install (e.g., `"22.x"`, `"20.x"`). Passed to `NodeTool@0` `versionSpec`. Defaults to `"22.x"`. |
+| `version` | string | Node.js version to install (e.g., `"22.x"`, `"20.x"`). Passed to `UseNode@1` `version`. Defaults to `"22.x"`. |
 | `feed-url` | string | Internal npm registry URL. Injects `NPM_CONFIG_REGISTRY` env var into the agent environment. |
 | `config` | string | Path to an .npmrc config file. Accepted with a warning — the file will not be available inside the AWF agent environment until proxy-auth support lands. |
 
 When enabled, the compiler:
-- Contributes a `NodeTool@0` task to `Declarations::agent_prepare_steps` (runs before AWF)
+- Contributes a `UseNode@1` task to `Declarations::agent_prepare_steps` (runs before AWF)
 - If `feed-url` or `config` is set, also injects `npmAuthenticate@0` (and an ensure-`.npmrc` step) to authenticate the ADO build service identity for internal feeds
 - Auto-adds `node`, `npm`, `npx` to the bash command allow-list
 - Adds Node ecosystem domains to the network allowlist (npmjs.org, nodejs.org, etc.)
 - If `feed-url` is set, injects `NPM_CONFIG_REGISTRY` env var into the agent environment
 - Appends a prompt supplement informing the agent about Node.js availability
-- No AWF mounts or PATH prepends needed — `NodeTool@0` installs to `/opt/hostedtoolcache` (auto-mounted by AWF) and publishes PATH entries that AWF merges via `$GITHUB_PATH`
+- No AWF mounts or PATH prepends needed — `UseNode@1` installs to `/opt/hostedtoolcache` (auto-mounted by AWF) and publishes PATH entries that AWF merges via `$GITHUB_PATH`
 - Note: AWF overlays `~/.npmrc` with `/dev/null` for credential security — the `NPM_CONFIG_REGISTRY` env var approach avoids conflicting with this overlay
 
 ### .NET (`dotnet:`)

site/src/content/docs/guides/extending.mdx

@@ -122,12 +122,12 @@ let step = Step::Bash(
 use crate::compile::ir::step::{Step, TaskStep};
 
 let step = Step::Task(
-    TaskStep::new("NodeTool@0", "Install Node.js")
-        .with_input("versionSpec", "20.x"),
+    TaskStep::new("UseNode@1", "Install Node.js")
+        .with_input("version", "20.x"),
 );
 ```
 
-Use `TaskStep` for Azure DevOps built-in tasks such as `NodeTool@0`, `UsePythonVersion@0`, and `UseDotNet@2`.
+Use `TaskStep` for Azure DevOps built-in tasks such as `UseNode@1`, `UsePythonVersion@0`, and `UseDotNet@2`.
 
 ### Download and publish steps
 

site/src/content/docs/reference/ado-script.mdx

@@ -139,7 +139,7 @@ the agent prompt, then exits 0 so the rest of the pipeline can continue.
        ┌──────────────────────┐
        │  Generated pipeline  │
        │  Setup job:          │
-       │   1. NodeTool@0      │
+       │   1. UseNode@1       │
        │   2. curl + sha256   │     downloads ado-script.zip
        │      + unzip         │     from the matching ado-aw release
        │   3. node gate/index │     reads GATE_SPEC env var
@@ -314,7 +314,7 @@ bundle**:
 When `filters:` lowers to non-empty checks, `AdoScriptExtension::declarations()`
 returns three typed `Declarations::setup_steps` entries for the Setup job:
 
-1. **`NodeTool@0`** — installs Node 20.x LTS, capped at
+1. **`UseNode@1`** — installs Node 22.x LTS, capped at
    `timeoutInMinutes: 5`.
 2. **`curl` download + verify + extract** — fetches `checksums.txt`
    and `ado-script.zip` from the `githubnext/ado-aw` release matching
@@ -333,7 +333,7 @@ download first, then appends the relevant invocation steps.
 
 **`import.js` invocation** — active when `inlined-imports: false` (the default):
 
-1. **`NodeTool@0`** — installs Node 20.x LTS, capped at `timeoutInMinutes: 5`.
+1. **`UseNode@1`** — installs Node 22.x LTS, capped at `timeoutInMinutes: 5`.
 2. **`curl` download + verify + extract** — same artefact and verification as the Setup job.
 3. **`bash: node '/tmp/ado-aw-scripts/ado-script/import.js'`** —
    expands `{{#runtime-import …}}` markers in
@@ -469,7 +469,7 @@ If a future bundle blows the budget:
   Node. Stage 3 keeps a Rust-only execution path.
 - Migrating the agent-stats parser. It runs in-pipeline as part of
   Stage 1 wrap-up and has no TypeScript dependency need.
-- Bundling Node itself. Pipelines install Node via `NodeTool@0`.
+- Bundling Node itself. Pipelines install Node via `UseNode@1`.
 
 ## See also
 

site/src/content/docs/reference/filter-ir.mdx

@@ -365,7 +365,7 @@ runtime-import resolver — see [Runtime Imports](/ado-aw/reference/runtime-impo
 
 For the gate path it controls:
 
-1. **Node install step** -- emits a `NodeTool@0` step pinned to Node 20.x
+1. **Node install step** -- emits a `UseNode@1` step pinned to Node 22.x
    LTS so the gate evaluator has a runtime.
 2. **Download step** -- fetches `ado-script.zip` from the ado-aw release
    artifacts, verifies its SHA256 checksum via `checksums.txt`, then

site/src/content/docs/reference/front-matter.mdx

@@ -51,7 +51,7 @@ runtimes:                      # optional runtime configuration (language enviro
   # python:                    # Alternative object format (pin version, configure internal feed)
   #   version: "3.12"
   #   feed-url: "https://pkgs.dev.azure.com/myorg/_packaging/myfeed/pypi/simple/"
-  # node: true                 # Node.js runtime -- auto-installs via NodeTool@0 (see docs/runtimes.md)
+  # node: true                 # Node.js runtime -- auto-installs via UseNode@1 (see docs/runtimes.md)
   # node:                      # Alternative object format (pin version, configure internal feed)
   #   version: "22.x"
   #   feed-url: "https://pkgs.dev.azure.com/ORG/PROJECT/_packaging/FEED/npm/registry/"