Add build plugin to check Node versions

[mbg]

Adds a plugin to build.mjs which checks that all the Node versions in the action.yml files for JavaScript-based actions are the same.

Risk assessment

For internal use only. Please select the risk level of this change:

• Low risk: Changes are fully under feature flags, or have been fully tested and validated in pre-production environments and are highly observable, or are documentation or test only.

Which use cases does this change impact?

Environments:

• Testing/None - This change does not impact any CodeQL workflows in production.

How did/will you validate this change?

• End-to-end tests - I am depending on PR checks (i.e. tests in pr-checks).

If something goes wrong after this change is released, what are the mitigation and rollback strategies?

• Development/testing only - This change cannot cause any failures in production.

How will you know if something goes wrong after this change is released?

• Other - Please provide details.

Are there any special considerations for merging or releasing this change?

• No special considerations - This change can be merged at any time.

Merge / deployment checklist

• Confirm this change is backwards compatible with existing workflows.
• Consider adding a changelog entry for this change.
• Confirm the readme and docs have been updated if necessary.

[Copilot]

Pull request overview

Adds a build-time check to ensure all JavaScript-based GitHub Actions in this repo use a consistent runs.using Node version, and introduces .nvmrc as the single source of truth for workflows to read/compare versions.

Changes:

• Add an esbuild onStart plugin in build.mjs to scan action.yml files, verify a single Node version is used, and write that version to .nvmrc.
• Add .nvmrc (currently 24) to pin the repo’s Node version.
• Update pr-checks.yml to use .nvmrc for the backport Node-version check and shorten the job timeout.

Show a summary per file

File	Description
build.mjs	Adds a build plugin that validates runs.using Node versions and writes .nvmrc.
.nvmrc	Introduces a pinned Node version file (24).
.github/workflows/pr-checks.yml	Switches the backport Node-version check to compare .nvmrc and adjusts job conditions/timeouts.

Copilot's findings

Comments suppressed due to low confidence (1)

.github/workflows/pr-checks.yml:137

• Same issue here: actions/checkout expects fetch-depth, not depth, so this input will be ignored.

        uses: actions/checkout@v6
        with:
          ref: ${{ env.BASE_REF }}
          depth: 1

• Files reviewed: 3/3 changed files
• Comments generated: 5