chore(actions): use gov repo for reused actions

[avivkeller]

🎉 We now have nodejs/web-team, which'll contain our re-used actions.

This should make our lives a bit easier, as we don't need to update a thousand workflows whenever something changes.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Preview	Updated (UTC)
nodejs-org	Ready	Preview	Sep 1, 2025 0:53am

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 76.60%. Comparing base (9f16142) to head (a6dba02).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #7904      +/-   ##
==========================================
+ Coverage   76.56%   76.60%   +0.04%     
==========================================
  Files         115      115              
  Lines        9595     9595              
  Branches      322      321       -1     
==========================================
+ Hits         7346     7350       +4     
+ Misses       2248     2244       -4     
  Partials        1        1              

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[github-actions]

Lighthouse Results

URL	Performance	Accessibility	Best Practices	SEO	Report
/en	🔴 74	🟢 100	🟢 100	🟢 100	🔗
/en/about	🟢 99	🟢 97	🟢 100	🟠 88	🔗
/en/about/previous-releases	🟢 96	🟢 93	🟢 100	🟢 100	🔗
/en/download	🟢 90	🟢 100	🟢 100	🟢 100	🔗
/en/download/archive/current	🟢 99	🟢 100	🟢 100	🟢 100	🔗
/en/blog	🟢 99	🟢 100	🟢 96	🟢 100	🔗

[Copilot]

Pull Request Overview

This PR centralizes GitHub Actions and governance docs by removing local copies and reusing workflows and actions from the nodejs/web-team repository.

• Added a link to the external Governance Document in README and removed the local GOVERNANCE.md
• Updated all workflows to use the shared setup-environment action or reuse workflows from nodejs/web-team
• Cleaned up CODEOWNERS and removed the old governance-related workflows and scripts

Reviewed Changes

Copilot reviewed 16 out of 16 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
README.md	Added [Governance Document] link and reference
GOVERNANCE.md	Removed local governance file
.github/workflows/translations-sync.yml	Replaced setup steps with shared setup-environment action
.github/workflows/scorecard.yml	Replaced inline steps with reusable workflow invocation
.github/workflows/publish-packages.yml	Swapped setup steps for shared environment action
.github/workflows/playwright.yml	Swapped setup steps for shared environment action
.github/workflows/playwright-cloudflare-open-next.yml	Swapped setup steps for shared environment action
.github/workflows/notify-on-push.yml	Replaced Slack step with reusable notify-on-push action
.github/workflows/lint-and-tests.yml	Swapped setup steps for shared environment action
.github/workflows/find-inactive-collaborators.yml	Removed this workflow entirely
.github/workflows/dependency-review.yml	Replaced inline dependency review with reusable workflow
.github/workflows/codeql.yml	Replaced inline CodeQL setup with reusable workflow
.github/workflows/chromatic.yml	Swapped setup steps for shared environment action
.github/workflows/build.yml	Swapped setup steps for shared environment action
.github/scripts/report-inactive-collaborators.mjs	Removed reporting script
.github/CODEOWNERS	Removed GOVERNANCE.md ownership entry

Comments suppressed due to low confidence (3)

.github/workflows/scorecard.yml:26

• When invoking a reusable workflow, you must include a ref (e.g., @main) to pin to a specific version: uses: nodejs/web-team/.github/workflows/scorecard.yml@main.

    uses: nodejs/web-team/.github/workflows/scorecard.yml

.github/workflows/dependency-review.yml:18

• Add a ref to the reusable workflow usage (e.g., @main) so that the workflow invocation is versioned and stable: uses: nodejs/web-team/.github/workflows/dependency-review.yml@main.

    uses: nodejs/web-team/.github/workflows/dependency-review.yml

.github/workflows/codeql.yml:17

• Include a specific ref on the reusable workflow invocation (e.g., @main) and verify that the target file supports reusable workflow inputs.

    uses: nodejs/web-team/.github/workflows/codeql.yml

[bmuenzenmeyer]

we cannot assume another repo is safe. this is a huge vulnerability

• malicious upstream
• disgruntled contributor
• compromised developer machine

https://blog.rafaelgss.dev/why-you-should-pin-actions-by-commit-hash

[avivkeller]

Typically, that's the case, but I feel like since we are scoping the permissions almost identically to the ones here, the risk of compromising that repository is identical to the risk of compromising this repository.

If an attacker somehow gained permissions on that repo via a leaked access token, for example, they would already have access in this repository.

[bmuenzenmeyer]

Typically, that's the case, but I feel like since we are scoping the permissions almost identically to the ones here, the risk of compromising that repository is identical to the risk of compromising this repository.

If an attacker somehow gained permissions on that repo via a leaked access token, for example, they would already have access in this repository.

points taken, but that doesn't necessarily make me feel much better. the indirection of this repo and setup in the name of simplification and reuse only serves to make our environment harder to understand, and IMO, less secure in the long run. but now i am dredging up past disagreements and should self-moderate.

i will lift my block if the majority approves of this approach...

@RafaelGSS - I invoked your blog post before - curious if you have any wisdom that could help us here

[avivkeller]

I'll add the explicit commits. We can always change it the future.

[bjohansebas]

LGTM

[avivkeller]

[avivkeller]

Since the TSC hasn't approved this, adding to their agenda for visibility: We just need one approval for this to land, thanks!

[BridgeAR]

I just read through the topic and I am not sure in what way things where changed since the beginning. If I am not mistaken, the current state is considered fine by the overall web team? I didn't look into the change closely, and I would handle it as @RafaelGSS.
If you do not have any concerns left, I am fine to approve for the CODEOWNERS file change.

@avivkeller when marking something for the TSC, please add a brief summary of what we should have a look at in particular.

[ovflowd]

@avivkeller have you added a summary for the TSC? Is this still relevant for TSC's agenda?

[avivkeller]

It's really just for visibility. We just need them to approve this PR, that's all

[avivkeller]

@ovflowd can you bypass the merge queue (and the TSC approval)

[ovflowd]

@avivkeller apologies, missed this comment. Can you rebase?

[ovflowd]

@avivkeller could you rebase again? 😭 feel free to merge right after.

[ovflowd]

@avivkeller there are still conflicts 🥲