Docker action pins Node 18 but installs danger-js unpinned

[Velin92]

What happens

Every run of the danger/swift GitHub Action has been failing since
2026-08-23 ~20:35 UTC. It crashes before the Dangerfile is read:

/usr/lib/node_modules/danger/node_modules/undici/lib/web/webidl/index.js:537
webidl.is.File = webidl.util.MakeTypeAssertion(File)
                                               ^
ReferenceError: File is not defined
    at Object.<anonymous> (/usr/lib/node_modules/danger/node_modules/undici/lib/web/webidl/index.js:537:48)
    ...
Node.js v18.20.8

Example run (public):
https://github.com/element-hq/element-x-ios/actions/runs/32723000687/job/97418215267

Cause

The Dockerfile installs Node 18 and then installs danger unpinned:

&& curl -sL https://deb.nodesource.com/setup_18.x | bash - \
&& apt-get install -qy nodejs \
&& npm install -g danger \

danger 14.0.4 was published 2026-08-23T20:35Z and moved from
undici@6.21.1 to undici@^7.16.0. undici 7 declares
engines.node >= 20.18.1 and references the global File, which only
exists from Node 20. On Node 18 it throws at require time.

danger-js	undici	required node
13.0.10 (2026-06-25)	6.21.1	>= 18.17 ✅
14.0.4 (2026-08-23)	^7.16.0	>= 20.18.1 ❌
14.0.5 (2026-08-24)	^7.16.0	>= 20.18.1 ❌

The install still succeeds because npm only enforces the top-level
engines field; a transitive mismatch is a non-fatal EBADENGINE
warning. So the image builds green and dies at runtime.

Note this is not fixable downstream: the action is a Docker action whose
image is rebuilt per run, so pinning uses: danger/swift@<sha> gives no
protection against the unpinned npm install -g danger inside it.

Suggested fix

1. setup_18.x → setup_20.x. Node 18 has been EOL since April 2025.
2. Pin the danger-js version (npm install -g danger@<x.y.z>) so a new
   major can't land in a SHA-pinned action without a release here.

(1) alone unblocks everyone; (2) prevents the recurrence.