ci: restore Node 24.x for publish, patch jsonschema URL resolution

[ymc9]

Follow-up to #2836, which fixed the build but broke publishing.

What went wrong

#2836 pinned the publish job to Node 22.x to dodge a langium generate crash on Node 24.20.0. The build then passed, but the publish step failed:

npm notice publish Signed provenance statement with source and build information from GitHub Actions
npm error code E404
npm error 404 Not Found - PUT https://registry.npmjs.org/@zenstackhq%2fcommon-helpers

The job has no NODE_AUTH_TOKEN — #2680 removed it when switching to npm trusted publishing (OIDC), and bumped Node 22.x → 24.x in the same commit, because trusted publishing requires npm ≥ 11.5.1:

Node	bundled npm	OIDC trusted publishing
22.23.2	10.9.8	✗
24.18.0	11.16.0	✓
24.20.0	11.19.0	✓ (but crashed langium generate)

Under Node 22, npm 10 ignores OIDC and falls back to the .npmrc authToken, which setup-node leaves as the literal placeholder XXXXX-XXXXX-XXXXX-XXXXX → unauthenticated PUT → npm's usual E404. Provenance still signed, since that path uses the Actions OIDC token directly rather than registry auth.

This PR

Restores node-version: 24.x and fixes the actual defect instead.

jsonschema@1.5.0 resolves $refs with new URL(ref, 'thismessage::/'). That base has an opaque path (note the double colon), so resolving a path-absolute reference against it is invalid per the URL spec. Node ≤ 24.18.0 accepted it; Node 24.20.0's updated ada correctly throws ERR_INVALID_URL, which surfaces as:

TypeError: Invalid URL
    at Validator.resolve (.../jsonschema@1.5.0/lib/validator.js:263:16)
  input: '/undefined#/$defs/languageItem', base: 'thismessage::/'

The patch changes the base to thismessage:/, restoring the pre-24.20.0 resolution result on every Node version. jsonschema@1.5.0 is the latest release and langium-cli@4.4.0 still depends on ~1.5.0, so there is no upgrade path.

Verification

Under Node 24.20.0 (the version the failing runner used):

• pnpm --filter @zenstackhq/language build succeeds, with no change to generated sources.
• Schema validation still works — corrupting langium-config.json yields instance.languages[0].grammar is not of a type(s) string, which exercises the exact $ref path that used to throw.

🤖 Generated with Claude Code

Summary by CodeRabbit

• Bug Fixes

  • Improved schema reference resolution for property pointers and fallback URLs.
  • Applied a compatibility fix to improve schema-based validation behavior.

• Chores

  • Updated release and testing environments to use Node.js 24 for improved runtime support.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: 49065c37-bf03-4bf3-aa53-ee52252e3a26

📥 Commits

Reviewing files that changed from the base of the PR and between 199b3f0 and c145c90.

📒 Files selected for processing (1)

• .github/workflows/build-test.yml

Included review availability: Your plan provides up to 8 included reviews per hour; 6 remain after this review.

---

📝 Walkthrough

Walkthrough

The build-test and release workflows now use Node.js 24.x. The pnpm configuration applies a patch to jsonschema 1.5.0. The patch changes the fallback URL base for schema property pointer resolution.

Changes

Release and schema updates

Layer / File(s)	Summary
jsonschema patch application patches/jsonschema@1.5.0.patch, package.json	The patch changes the fallback URL base from thismessage::/ to thismessage:/. The pnpm configuration applies the patch to jsonschema@1.5.0.
CI and release Node.js runtimes .github/workflows/build-test.yml, .github/workflows/publish-release.yml	The build-test and publish-and-release jobs now use Node.js 24.x instead of 22.x.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Merge Risk: ⚪ Minimal · up to c145c

CI and release workflows now use Node.js 24.x, with the jsonschema URL-resolution patch applied for compatibility. No concrete merge-blocking risk remains.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes both main changes: restoring Node.js 24.x in CI and publish workflows, and patching jsonschema URL resolution.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch ci/publish-node24-jsonschema-patch

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[ymc9]

Also bumps the build-test matrix from 22.x to 24.x (c145c90), so CI and publish run the same Node. That only works with the jsonschema patch in this PR — on dev today, a 24.x matrix would hit the same langium generate crash.

Verified locally on Node 24.20.0 (the version that broke the publish runner):

• pnpm run build — 27/27 tasks pass, no change to generated sources.
• TEST_DB_PROVIDER=sqlite pnpm run test — all packages pass. Two tests failed under full-suite contention on my machine (tests/regression/test/v2-migrated/issue-632.test.ts on a prisma db push, and rejects Unsupported fields in orderBy in tests/e2e/orm/client-api/unsupported.test.ts at 9.4s); both pass in isolation on 24.20.0, so they're local load flakes, not Node 24 regressions.
• packages/server alone: 338/338 pass.

Note better-sqlite3 needs a rebuild when switching Node major locally (pnpm rebuild -r better-sqlite3); CI installs fresh, so it's unaffected.