chore: upgrade node and pnpm

[jasonsaayman]

This pull request introduces two main sets of changes: (1) upgrades the repository toolchain to Node.js 24 and pnpm 11, and (2) designs and specifies a new feature for posting bundle-size comparison comments directly on pull requests. The toolchain upgrade updates all relevant metadata, documentation, and CI configuration to ensure alignment with the new runtime and package manager. The new PR comment feature is thoroughly designed and specified but not yet implemented in code.

Toolchain upgrade to Node 24 and pnpm 11:

• Updated the GitHub Action runtime to use node24 in action.yml, and aligned all documentation and workflow files to require Node.js 24 and pnpm 11. [1] [2] [3] [4] [5]
• Updated the example workflow to use pinned versions of actions/checkout, pnpm/action-setup, and actions/setup-node compatible with Node 24 and pnpm 11, and switched the test tarball to axios. [1] [2]
• Added OpenSpec documentation for the upgrade, including context, goals, decisions, risks, and migration plan. [1] [2]

Design and specification for PR bundle-size comments:

• Added detailed design documents, requirements, and tasks for a new feature: posting or updating a Markdown summary of bundle-size comparisons as a comment on pull requests. This includes opt-in configuration, GitHub token usage, comment formatting, status emoji, and update logic to avoid duplicate comments. [1] [2] [3] [4]
• Specified that the JSON report and outputs remain unchanged, and that the comment status is informational only (does not affect action success/failure). [1] [2]

These changes ensure the repository uses a modern, consistent toolchain and lay the groundwork for a user-friendly PR comment feature that will make bundle-size changes more visible to reviewers.

References: [1] [2] [3] [4] [5] [6] [7] [8] [9] [10] [11] [12]

---

Summary by cubic

Upgrades the action runtime to Node 24 and standardizes the repo on pnpm 11; behavior is unchanged. Adds OpenSpec design/specs for a future optional PR bundle-size comment feature (docs only; not implemented).

• Dependencies

  • action.yml now uses node24; package.json requires Node >=24 and pnpm >=11 (<12) with packageManager: pnpm@11.1.2.
  • Example workflow pins actions/checkout, pnpm/action-setup (sets pnpm 11.1.2), and actions/setup-node, and runs on Node 24 with pnpm cache.
  • Test tarball switched to axios (axios.min.js); added tests to verify runtime/toolchain metadata.

• Migration

  • Runners must support Node 24.
  • Use pnpm 11 (via Corepack) and Node 24 for local dev and CI.
  • No changes to action inputs, JSON report, or outputs.

^{Written for commit 10373a8. Summary will update on new commits. Review in cubic}

[cubic-dev-ai]

2 issues found across 17 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name=".github/workflows/bundle-size.yml">

<violation number="1" location=".github/workflows/bundle-size.yml:51">
P1: The workflow now compares `axios.min.js`, but the fixture step only creates `index.js`, so the configured file is missing and the bundle-size run will fail.</violation>
</file>

<file name="openspec/changes/add-pr-bundle-size-comments/design.md">

<violation number="1" location="openspec/changes/add-pr-bundle-size-comments/design.md:66">
P2: The spec defines conflicting behavior for non-PR runs with `comment-pr` enabled: one section requires failing when token is missing, another requires skipping comments and succeeding on non-PR events. Clarify token validation to apply only when a PR comment attempt is possible.</violation>
</file>

_{You're on the cubic free plan with 15 free PR reviews remaining this month. Upgrade for unlimited reviews.
Re-trigger cubic}