fix: harden npm package lifecycle and Node support

Author: mldangelo-oai

.github/workflows/node-ci.yml

@@ -10,12 +10,16 @@ permissions:
 
 jobs:
   test:
-    name: ${{ matrix.os }} / node-22
+    name: ${{ matrix.os }} / node-${{ matrix.node }}
     runs-on: ${{ matrix.os }}
     strategy:
       fail-fast: false
       matrix:
         os: [ubuntu-latest, macos-latest, windows-latest]
+        node: ["22"]
+        include:
+          - os: ubuntu-latest
+            node: "24"
 
     steps:
       - name: Checkout repository
@@ -26,7 +30,7 @@ jobs:
       - name: Set up Node.js
         uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
         with:
-          node-version: "22"
+          node-version: ${{ matrix.node }}
 
       - name: Set up Bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
@@ -40,6 +44,10 @@ jobs:
       - name: Install dependencies
         run: pnpm --dir sdk/typescript install --frozen-lockfile
 
+      - name: Audit production dependencies
+        if: matrix.os == 'ubuntu-latest' && matrix.node == '22'
+        run: pnpm --dir sdk/typescript run audit:prod
+
       - name: Typecheck
         run: pnpm --dir sdk/typescript run types
 

.github/workflows/node-release.yml

@@ -97,6 +97,9 @@ jobs:
       - name: Install dependencies
         run: sfw pnpm --dir sdk/typescript install --frozen-lockfile
 
+      - name: Audit production dependencies
+        run: sfw pnpm --dir sdk/typescript run audit:prod
+
       - name: Verify
         run: |
           pnpm --dir sdk/typescript run types

README.md

@@ -8,7 +8,7 @@
 
 ## Quick start
 
-Requires Node.js 22 or later, Python 3.10 or later, and access to Codex Security.
+Requires Node.js 22.13.0 or later, Python 3.10 or later, and access to Codex Security.
 
 ```bash
 npm install @openai/codex-security

sdk/typescript/README.md

@@ -15,7 +15,7 @@ npm install @openai/codex-security
 npx @openai/codex-security --version
 ```
 
-The package supports macOS, Linux, and Windows and requires Node.js 22 or
+The package supports macOS, Linux, and Windows and requires Node.js 22.13.0 or
 later. Scanning and exporting findings also require Python 3.10 or later. If
 you use Python 3.10, install the `tomli` package. Select another interpreter
 with `--python`, `pythonPath`, or `PYTHON` when needed.

sdk/typescript/package.json

@@ -13,7 +13,7 @@
   "bugs": "https://github.com/openai/codex-security/issues",
   "type": "module",
   "engines": {
-    "node": ">=22"
+    "node": ">=22.13.0"
   },
   "packageManager": "pnpm@11.9.0+sha512.bd682d5d03fe525ef7c9fd6780c6884d1e756ac4c9c9fe00c538782824310dcf90e3ddc4f53835f06dfaebd5085e41855e0bcbb3b60de2ac5bbab89e5036f03b",
   "main": "./dist/index.js",
@@ -39,13 +39,15 @@
     "access": "public"
   },
   "scripts": {
+    "audit:prod": "pnpm audit --prod --audit-level high",
     "clean": "node -e \"require('node:fs').rmSync('dist',{recursive:true,force:true})\"",
     "build": "pnpm run clean && tsc -p tsconfig.build.json",
     "check:package": "node scripts/check-package.mjs",
     "format": "prettier --check --ignore-path .gitignore --ignore-path .prettierignore \"**/*.{cjs,mjs,js,ts,json,md}\"",
     "generate:models": "node scripts/generate-models.cjs",
     "generate:models:check": "node scripts/generate-models.cjs --check",
     "lint": "tsc --noEmit",
+    "prepack": "pnpm run build",
     "test": "bun test --timeout 30000 ./tests-ts",
     "test:package": "node scripts/smoke-package.mjs",
     "types": "pnpm run generate:models:check && tsc --noEmit"

sdk/typescript/tests-ts/skeleton.test.ts

@@ -28,6 +28,32 @@ function capture(): {
 }
 
 describe("TypeScript package skeleton", () => {
+  test("advertises only compatible Node.js releases", async () => {
+    const packageJson = JSON.parse(
+      await readFile(new URL("../package.json", import.meta.url), "utf8"),
+    );
+
+    expect(Bun.semver.satisfies("22.12.0", packageJson.engines.node)).toBe(
+      false,
+    );
+    expect(Bun.semver.satisfies("22.13.0", packageJson.engines.node)).toBe(
+      true,
+    );
+    expect(Bun.semver.satisfies("24.0.0", packageJson.engines.node)).toBe(true);
+    expect(Bun.semver.satisfies("26.0.0", packageJson.engines.node)).toBe(true);
+  });
+
+  test("builds packages before packing and provides a production audit", async () => {
+    const packageJson = JSON.parse(
+      await readFile(new URL("../package.json", import.meta.url), "utf8"),
+    );
+
+    expect(packageJson.scripts.prepack).toBe("pnpm run build");
+    expect(packageJson.scripts["audit:prod"]).toBe(
+      "pnpm audit --prod --audit-level high",
+    );
+  });
+
   test("exposes canonical finding and hardening fields with public types", () => {
     const finding = {} as Finding;
     const scan = {} as ScanRecord;