fix(ci): dedupe release

[avivkeller]

cc @bmuenzenmeyer will this fix https://github.com/nodejs/doc-kit/actions/workflows/release.yml?

[cursor]

PR Summary

Low Risk
CI-only change; release behavior should stay the same if the composite action covers checkout and tooling, with a possible shift in harden-runner egress policy from the removed audit step.

Overview
The release workflow no longer runs standalone Harden Runner and Checkout steps before Changesets.

Checkout and environment setup are folded into nodejs/web-team/actions/setup-environment, with fetch-depth: 0 passed there so Changesets still gets full git history for version bumps, tags, and pushes.

^{Reviewed by Cursor Bugbot for commit d161066. Bugbot is set up for automated code reviews on this repo. Configure here.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
api-docs-tooling	Ready	Preview	Jul 11, 2026 12:07am

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 85.12%. Comparing base (7bf9efc) to head (d161066).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #890   +/-   ##
=======================================
  Coverage   85.12%   85.12%           
=======================================
  Files         180      180           
  Lines       16581    16581           
  Branches     1513     1512    -1     
=======================================
  Hits        14114    14114           
  Misses       2457     2457           
  Partials       10       10           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit d161066. Configure here.}

[github-actions]

api-links Generator

apilinks.json

Expected values to be strictly deep-equal:
+ actual - expected
... Skipped lines

  {
    'Agent.defaultMaxSockets': 'https://github.com/nodejs/node/blob/HEAD/lib/_http_agent.js#L291',
    'Buffer.alloc': 'https://github.com/nodejs/node/blob/HEAD/lib/buffer.js#L435',
    'Buffer.allocUnsafe': 'https://github.com/nodejs/node/blob/HEAD/lib/buffer.js#L449',
    'Buffer.allocUnsafeSlow': 'https://github.com/nodejs/node/blob/HEAD/lib/buffer.js#L461',
...
    'agent.addRequest': 'https://github.com/nodejs/node/blob/HEAD/lib/_http_agent.js#L356',
+   'agent.createConnection': 'https://github.com/nodejs/node/blob/HEAD/lib/_http_agent.js#L295',
-   'agent.createConnection': 'https://github.com/nodejs/node/blob/HEAD/lib/https.js#L326',
    'agent.createSocket': 'https://github.com/nodejs/node/blob/HEAD/lib/_http_agent.js#L427',
    'agent.destroy': 'https://github.com/nodejs/node/blob/HEAD/lib/_http_agent.js#L660',
+   'agent.getName': 'https://github.com/nodejs/node/blob/HEAD/lib/_http_agent.js#L325',
-   'agent.getName': 'https://github.com/nodejs/node/blob/HEAD/lib/https.js#L484',
    'agent.keepSocketAlive': 'https://github.com/nodejs/node/blob/HEAD/lib/_http_agent.js#L616',
    'agent.removeSocket': 'https://github.com/nodejs/node/blob/HEAD/lib/_http_agent.js#L555',
    'agent.reuseSocket': 'https://github.com/nodejs/node/blob/HEAD/lib/_http_agent.js#L652',
    'assert.assert': 'https://github.com/nodejs/node/blob/HEAD/lib/assert.js#L185',
    'asyncResource.asyncId': 'https://github.com/nodejs/node/blob/HEAD/lib/async_hooks.js#L243',
...
    'server.address': 'https://github.com/nodejs/node/blob/HEAD/lib/net.js#L2463',
+   'server.close': 'https://github.com/nodejs/node/blob/HEAD/lib/_http_server.js#L671',
+   'server.closeAllConnections': 'https://github.com/nodejs/node/blob/HEAD/lib/_http_server.js#L681',
+   'server.closeIdleConnections': 'https://github.com/nodejs/node/blob/HEAD/lib/_http_server.js#L693',
-   'server.close': 'https://github.com/nodejs/node/blob/HEAD/lib/net.js#L2596',
-   'server.closeAllConnections': 'https://github.com/nodejs/node/blob/HEAD/lib/https.js#L120',
-   'server.closeIdleConnections': 'https://github.com/nodejs/node/blob/HEAD/lib/https.js#L122',
    'server.getConnections': 'https://github.com/nodejs/node/blob/HEAD/lib/net.js#L2558',
    'server.listen': 'https://github.com/nodejs/node/blob/HEAD/lib/net.js#L2265',
    'server.ref': 'https://github.com/nodejs/node/blob/HEAD/lib/net.js#L2701',
+   'server.setTimeout': 'https://github.com/nodejs/node/blob/HEAD/lib/_http_server.js#L709',
-   'server.setTimeout': 'https://github.com/nodejs/node/blob/HEAD/lib/https.js#L124',
    'server.unref': 'https://github.com/nodejs/node/blob/HEAD/lib/net.js#L2710',
+   'server[SymbolAsyncDispose]': 'https://github.com/nodejs/node/blob/HEAD/lib/_http_server.js#L677',
+   'server[undefined]': 'https://github.com/nodejs/node/blob/HEAD/lib/_http_server.js#L716',
-   'server[SymbolAsyncDispose]': 'https://github.com/nodejs/node/blob/HEAD/lib/net.js#L2636',
-   'server[undefined]': 'https://github.com/nodejs/node/blob/HEAD/lib/net.js#L2665',
    'serverresponse._finish': 'https://github.com/nodejs/node/blob/HEAD/lib/_http_server.js#L246',
    'serverresponse._implicitHeader': 'https://github.com/nodejs/node/blob/HEAD/lib/_http_server.js#L403',
    'serverresponse.assignSocket': 'https://github.com/nodejs/node/blob/HEAD/lib/_http_server.js#L296',
    'serverresponse.detachSocket': 'https://github.com/nodejs/node/blob/HEAD/lib/_http_server.js#L307',
    'serverresponse.statusCode': 'https://github.com/nodejs/node/blob/HEAD/lib/_http_server.js#L269',

orama-db Generator

File	Base	Head	Diff
orama-db.json	8.90 MB	8.90 MB	-1.06 KB (-0.01%)

web Generator

File	Base	Head	Diff
all.html	19.94 MB	19.94 MB	+234.00 B (+0.00%)

[bmuenzenmeyer]

looking now

[bmuenzenmeyer]

LGTM - forgot that setup-environment does much of this

[avivkeller]

Landing this w/o fast-track as a hotfix for CI failures on main