chore(workflow): update CI test matrix & use macos-26

.github/workflows/ci.yml

@@ -25,23 +25,52 @@ on:
     branches:
       - '*'
 
-permissions:
-  contents: read
-  security-events: write
-
 jobs:
+  codeql:
+    name: CodeQL Analysis
+    runs-on: ubuntu-latest
+
+    permissions:
+      contents: read
+      security-events: write
+
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+          fetch-depth: 1
+
+      - uses: github/codeql-action/init@9e0d7b8d25671d64c341c19c0152d693099fb5ba # v4.35.5
+        with:
+          languages: javascript
+          queries: security-and-quality
+          config: |
+            paths-ignore:
+              - coverage
+              - node_modules
+
+      - uses: github/codeql-action/analyze@9e0d7b8d25671d64c341c19c0152d693099fb5ba # v4.35.5
+
   test:
     name: NodeJS ${{ matrix.node.version }} on ${{ matrix.os }}
     runs-on: ${{ matrix.os }}
 
+    permissions:
+      contents: read
+
     strategy:
       matrix:
+        os: [ubuntu-latest, macos-26]
+        # The "--test-coverage-exclude" flag is supported in v22.5.0 and later.
+        # By default, all matching test files are excluded from the coverage report.
+        # Only Node.js 22.x requires explicitly declaring test file exclusions.
         node:
           - version: 20.x
+            options: ''
           - version: 22.x
-            options: --test-coverage-exclude="test/**/*.js"
+            options: --test-coverage-exclude=test/**/*.js
           - version: 24.x
-        os: [ubuntu-latest, macos-15]
+            options: ''
 
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -51,28 +80,18 @@ jobs:
 
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
-          node-version: ${{ matrix.node.version }}
+          node.version: ${{ matrix.node.version }}
 
       - name: Environment Information
         run: |
           node --version
           npm --version
 
-      - uses: github/codeql-action/init@9e0d7b8d25671d64c341c19c0152d693099fb5ba # v4.35.5
-        with:
-          languages: javascript
-          queries: security-and-quality
-          config: |
-            paths-ignore:
-              - coverage
-              - node_modules
-
       - name: npm install and test
         run: npm cit
         env:
           CI: true
-
-      - uses: github/codeql-action/analyze@9e0d7b8d25671d64c341c19c0152d693099fb5ba # v4.35.5
+          NODE_OPTIONS: ${{ matrix.node.options }}
 
       - uses: codecov/codecov-action@b9fd7d16f6d7d1b5d2bec1a2887e65ceed900238 # v4.6.0
         if: success()