fix(ci): pin Node 22.22.3 in Kanar workflow to avoid ERR_STREAM_PREMATURE_CLOSE #PLTM-1403

[lukaszjaskowski]

Motivation

Kanar (Danger-based CI) fails intermittently on PRs with ERR_STREAM_PREMATURE_CLOSE / "Failed to fetch GitHub pull request files / commits" before the dangerfile runs. GitHub Actions runner images were updated around 23 June 2026, bumping the default Node on ubuntu-latest from 22.22.3 to 22.23.0. Node 22.23.0+ and 24.17.0+ regressed http.Agent keep-alive behavior (nodejs/node#63989, CVE-2026-48931), which breaks node-fetch@2 used by Danger 13.x (danger/danger-js#1515).

Intended outcome

Kanar should reliably fetch PR metadata from GitHub instead of failing with premature stream close errors caused by the broken Node keep-alive behavior on runner default Node versions.

Overview of changes

• Add SHA-pinned actions/setup-node@v4 before the RampNetwork/kanar step in .github/workflows/kanar.yml.
• Pin node-version to "22.22.3" (last known good version on the ubuntu-latest default Node 22 line).
• No other workflow changes; temporary workaround until danger/danger-js#1516 or a patched Node release (nodejs/node#64004).

Quality assurance

• Risk: Low — single-step addition that downgrades Node from 22.23.0 to 22.22.3 for this job only; no app or build pipeline impact.
• Follow-up: Remove the pin once Danger ships a fix or Node releases a patched version.

[github-actions]

	Messages
📖	Jira issue(s) related to this PR: 🔗 Pin node version for kanar workflow to fix workflow failures [#PLTM-1403]

Generated by 🚫 dangerJS against e91fcd8