From 96093d097039ff9bd5bf33d3ffdfdef3f3515f5f Mon Sep 17 00:00:00 2001
From: Brynley Llewellyn-Roux <blynblack@gmail.com>
Date: Tue, 25 Mar 2025 11:03:22 +1100
Subject: [PATCH 01/34] fix: add `PYTHON` to macos native jobs

---
 .github/workflows/native-library-js-staging.yml | 1 +
 .github/workflows/native-library-js-tag.yml     | 1 +
 2 files changed, 2 insertions(+)

diff --git a/.github/workflows/native-library-js-staging.yml b/.github/workflows/native-library-js-staging.yml
index d1615f8..246a81d 100644
--- a/.github/workflows/native-library-js-staging.yml
+++ b/.github/workflows/native-library-js-staging.yml
@@ -120,6 +120,7 @@ jobs:
               mkdir -p "$CI_PROJECT_DIR/tmp"
               eval "$(brew shellenv)"
               ./scripts/brew-install.sh
+              export PYTHON=$(brew --prefix python@3.10)/bin/python3
               hash -r
               npm install --ignore-scripts
               export PATH="$(npm root)/.bin:$PATH"
diff --git a/.github/workflows/native-library-js-tag.yml b/.github/workflows/native-library-js-tag.yml
index 7304b60..86c374e 100644
--- a/.github/workflows/native-library-js-tag.yml
+++ b/.github/workflows/native-library-js-tag.yml
@@ -93,6 +93,7 @@ jobs:
             script: |
               eval "$(brew shellenv)"
               ./scripts/brew-install.sh
+              export PYTHON=$(brew --prefix python@3.10)/bin/python3
               hash -r
               npm install --ignore-scripts
               export PATH="$(npm root)/.bin:$PATH"

From 663b6ef921b233ba5fbafc80a480315e831565ae Mon Sep 17 00:00:00 2001
From: Brynley Llewellyn-Roux <blynblack@gmail.com>
Date: Tue, 25 Mar 2025 11:09:51 +1100
Subject: [PATCH 02/34] fix: use subversion for `python3` executable

---
 .github/workflows/native-library-js-staging.yml | 2 +-
 .github/workflows/native-library-js-tag.yml     | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/native-library-js-staging.yml b/.github/workflows/native-library-js-staging.yml
index 246a81d..9872d34 100644
--- a/.github/workflows/native-library-js-staging.yml
+++ b/.github/workflows/native-library-js-staging.yml
@@ -120,7 +120,7 @@ jobs:
               mkdir -p "$CI_PROJECT_DIR/tmp"
               eval "$(brew shellenv)"
               ./scripts/brew-install.sh
-              export PYTHON=$(brew --prefix python@3.10)/bin/python3
+              export PYTHON=$(brew --prefix python@3.10)/bin/python3.10
               hash -r
               npm install --ignore-scripts
               export PATH="$(npm root)/.bin:$PATH"
diff --git a/.github/workflows/native-library-js-tag.yml b/.github/workflows/native-library-js-tag.yml
index 86c374e..a696ce8 100644
--- a/.github/workflows/native-library-js-tag.yml
+++ b/.github/workflows/native-library-js-tag.yml
@@ -93,7 +93,7 @@ jobs:
             script: |
               eval "$(brew shellenv)"
               ./scripts/brew-install.sh
-              export PYTHON=$(brew --prefix python@3.10)/bin/python3
+              export PYTHON=$(brew --prefix python@3.10)/bin/python3.10
               hash -r
               npm install --ignore-scripts
               export PATH="$(npm root)/.bin:$PATH"

From b363b3e5198120b0fcffcec004a41fe767c44fbf Mon Sep 17 00:00:00 2001
From: Roger Qiu <roger.qiu@polyhack.io>
Date: Tue, 25 Mar 2025 14:13:37 +1100
Subject: [PATCH 03/34] fix: environment input has to be of type string

---
 .github/workflows/application-js-cloudflare-feature-closed.yml | 2 +-
 .github/workflows/application-js-cloudflare-feature.yml        | 2 +-
 .github/workflows/application-js-cloudflare-master.yml         | 2 +-
 .github/workflows/application-js-cloudflare-staging.yml        | 2 +-
 4 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/application-js-cloudflare-feature-closed.yml b/.github/workflows/application-js-cloudflare-feature-closed.yml
index b7fcefc..a3ca582 100644
--- a/.github/workflows/application-js-cloudflare-feature-closed.yml
+++ b/.github/workflows/application-js-cloudflare-feature-closed.yml
@@ -5,7 +5,7 @@ on:
     inputs:
       environment:
         description: 'Deployment Environment'
-        type: environment
+        type: string
         required: true
       appName:
         type: string
diff --git a/.github/workflows/application-js-cloudflare-feature.yml b/.github/workflows/application-js-cloudflare-feature.yml
index 494e591..1122c29 100644
--- a/.github/workflows/application-js-cloudflare-feature.yml
+++ b/.github/workflows/application-js-cloudflare-feature.yml
@@ -5,7 +5,7 @@ on:
     inputs:
       environment:
         description: 'Deployment Environment'
-        type: environment
+        type: string
         required: true
       ref:
         type: string
diff --git a/.github/workflows/application-js-cloudflare-master.yml b/.github/workflows/application-js-cloudflare-master.yml
index 79404a0..a993baf 100644
--- a/.github/workflows/application-js-cloudflare-master.yml
+++ b/.github/workflows/application-js-cloudflare-master.yml
@@ -5,7 +5,7 @@ on:
     inputs:
       environment:
         description: 'Deployment Environment'
-        type: environment
+        type: string
         required: true
       ref:
         type: string
diff --git a/.github/workflows/application-js-cloudflare-staging.yml b/.github/workflows/application-js-cloudflare-staging.yml
index cc69a45..60cc507 100644
--- a/.github/workflows/application-js-cloudflare-staging.yml
+++ b/.github/workflows/application-js-cloudflare-staging.yml
@@ -5,7 +5,7 @@ on:
     inputs:
       environment:
         description: 'Deployment Environment'
-        type: environment
+        type: string
         required: true
       ref:
         type: string

From 987d034e3a69525f854a29da074658ea29e8fdd5 Mon Sep 17 00:00:00 2001
From: Roger Qiu <roger.qiu@polyhack.io>
Date: Tue, 25 Mar 2025 14:21:56 +1100
Subject: [PATCH 04/34] chore: test receiving an environment variable

---
 .../application-js-cloudflare-feature.yml        | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/.github/workflows/application-js-cloudflare-feature.yml b/.github/workflows/application-js-cloudflare-feature.yml
index 1122c29..f8063ba 100644
--- a/.github/workflows/application-js-cloudflare-feature.yml
+++ b/.github/workflows/application-js-cloudflare-feature.yml
@@ -24,6 +24,22 @@ env:
   NIX_CONFIG: access-tokens = github.com=${{ secrets.NIXPKGS_PRIVATE_PAT }}
 
 jobs:
+  feature-test-secret:
+    name: "Feature / Secret Test"
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    environment: ${{ inputs.environment }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          lfs: true
+      - uses: MatrixAI/.github/.github/actions/matrixai-env-setup@master
+      - name: Run The Test
+        run: |
+          echo "WHAT IS THIS? $ABC AFTER THE ABC"
+          [ -n "$ABC" ] && echo "ABC is set and non-empty" || echo "ABC is not set or empty"
+
   # Lint the code
   feature-lint:
     name: "Feature / Lint"

From 33fb17389aa931b564a75e08f1d78d79055991bf Mon Sep 17 00:00:00 2001
From: Roger Qiu <roger.qiu@polyhack.io>
Date: Tue, 25 Mar 2025 14:27:55 +1100
Subject: [PATCH 05/34] chore: set the `env` for testing environment variables

---
 .github/workflows/application-js-cloudflare-feature.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/application-js-cloudflare-feature.yml b/.github/workflows/application-js-cloudflare-feature.yml
index f8063ba..122dc38 100644
--- a/.github/workflows/application-js-cloudflare-feature.yml
+++ b/.github/workflows/application-js-cloudflare-feature.yml
@@ -36,6 +36,8 @@ jobs:
           lfs: true
       - uses: MatrixAI/.github/.github/actions/matrixai-env-setup@master
       - name: Run The Test
+        env:
+          ABC: ${{ secrets.ABC }}
         run: |
           echo "WHAT IS THIS? $ABC AFTER THE ABC"
           [ -n "$ABC" ] && echo "ABC is set and non-empty" || echo "ABC is not set or empty"

From 18646d39cb52d6fb8bef7858348fd4b2c9d57dda Mon Sep 17 00:00:00 2001
From: Roger Qiu <roger.qiu@polyhack.io>
Date: Tue, 25 Mar 2025 14:35:47 +1100
Subject: [PATCH 06/34] chore: get the environment secrets from DEPLOY_SECRETS

---
 .../application-js-cloudflare-feature.yml         | 15 +++++++++++++--
 1 file changed, 13 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/application-js-cloudflare-feature.yml b/.github/workflows/application-js-cloudflare-feature.yml
index 122dc38..756613f 100644
--- a/.github/workflows/application-js-cloudflare-feature.yml
+++ b/.github/workflows/application-js-cloudflare-feature.yml
@@ -31,13 +31,24 @@ jobs:
       contents: read
     environment: ${{ inputs.environment }}
     steps:
+      - name: Checkout Actions
+        uses: actions/checkout@v4
+        with:
+          repository: MatrixAI/.github
+          ref: ${{ inputs.ref }}
+          path: tmp/.github
+      - name: Parse Secrets
+        uses: ./tmp/.github/.github/actions/secrets-parse
+        with:
+          secrets: ${{ secrets.DEPLOY_SECRETS }}
       - uses: actions/checkout@v4
         with:
           lfs: true
       - uses: MatrixAI/.github/.github/actions/matrixai-env-setup@master
+      - name: Setup Deploy Secrets
+        run: |
+          echo "${{ inputs.DEPLOY_SECRETS }}" | jq -r 'to_entries | .[] | "\(.key)=\(.value)"' >> $GITHUB_ENV
       - name: Run The Test
-        env:
-          ABC: ${{ secrets.ABC }}
         run: |
           echo "WHAT IS THIS? $ABC AFTER THE ABC"
           [ -n "$ABC" ] && echo "ABC is set and non-empty" || echo "ABC is not set or empty"

From f788d5621b2a1525f2aa381b5ca9a0b0337d0162 Mon Sep 17 00:00:00 2001
From: Roger Qiu <roger.qiu@polyhack.io>
Date: Tue, 25 Mar 2025 14:41:25 +1100
Subject: [PATCH 07/34] chore: maybe the `environment` key is useless if we use
 `DEPLOY_SECRETS`

---
 .github/workflows/application-js-cloudflare-feature.yml | 1 -
 1 file changed, 1 deletion(-)

diff --git a/.github/workflows/application-js-cloudflare-feature.yml b/.github/workflows/application-js-cloudflare-feature.yml
index 756613f..0e9b6f8 100644
--- a/.github/workflows/application-js-cloudflare-feature.yml
+++ b/.github/workflows/application-js-cloudflare-feature.yml
@@ -29,7 +29,6 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: read
-    environment: ${{ inputs.environment }}
     steps:
       - name: Checkout Actions
         uses: actions/checkout@v4

From 193e071ee5527fcc50925aecb0f5a2b3e2d6347f Mon Sep 17 00:00:00 2001
From: Roger Qiu <roger.qiu@polyhack.io>
Date: Tue, 25 Mar 2025 14:47:38 +1100
Subject: [PATCH 08/34] chore: the `environment` key seems to be useful for
 maintaining environment restrictions for the jobs, but not for passing the
 secrets because we are using `DEPLOY_SECRETS`

---
 .../application-js-cloudflare-feature.yml     | 28 -------------------
 1 file changed, 28 deletions(-)

diff --git a/.github/workflows/application-js-cloudflare-feature.yml b/.github/workflows/application-js-cloudflare-feature.yml
index 0e9b6f8..1122c29 100644
--- a/.github/workflows/application-js-cloudflare-feature.yml
+++ b/.github/workflows/application-js-cloudflare-feature.yml
@@ -24,34 +24,6 @@ env:
   NIX_CONFIG: access-tokens = github.com=${{ secrets.NIXPKGS_PRIVATE_PAT }}
 
 jobs:
-  feature-test-secret:
-    name: "Feature / Secret Test"
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-    steps:
-      - name: Checkout Actions
-        uses: actions/checkout@v4
-        with:
-          repository: MatrixAI/.github
-          ref: ${{ inputs.ref }}
-          path: tmp/.github
-      - name: Parse Secrets
-        uses: ./tmp/.github/.github/actions/secrets-parse
-        with:
-          secrets: ${{ secrets.DEPLOY_SECRETS }}
-      - uses: actions/checkout@v4
-        with:
-          lfs: true
-      - uses: MatrixAI/.github/.github/actions/matrixai-env-setup@master
-      - name: Setup Deploy Secrets
-        run: |
-          echo "${{ inputs.DEPLOY_SECRETS }}" | jq -r 'to_entries | .[] | "\(.key)=\(.value)"' >> $GITHUB_ENV
-      - name: Run The Test
-        run: |
-          echo "WHAT IS THIS? $ABC AFTER THE ABC"
-          [ -n "$ABC" ] && echo "ABC is set and non-empty" || echo "ABC is not set or empty"
-
   # Lint the code
   feature-lint:
     name: "Feature / Lint"

From 09af40f87d229a0ef0ff30d15f11eded3826aa3a Mon Sep 17 00:00:00 2001
From: Roger Qiu <roger.qiu@polyhack.io>
Date: Tue, 25 Mar 2025 14:51:08 +1100
Subject: [PATCH 09/34] chore: testing final security separation between
 environments

---
 .../application-js-cloudflare-feature.yml     | 31 +++++++++++++++++++
 1 file changed, 31 insertions(+)

diff --git a/.github/workflows/application-js-cloudflare-feature.yml b/.github/workflows/application-js-cloudflare-feature.yml
index 1122c29..d2a94e4 100644
--- a/.github/workflows/application-js-cloudflare-feature.yml
+++ b/.github/workflows/application-js-cloudflare-feature.yml
@@ -24,6 +24,37 @@ env:
   NIX_CONFIG: access-tokens = github.com=${{ secrets.NIXPKGS_PRIVATE_PAT }}
 
 jobs:
+  feature-test-secret:
+    name: "Feature / Secret Test"
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    environment: ${{ inputs.environment }}
+    steps:
+      - name: Checkout Actions
+        uses: actions/checkout@v4
+        with:
+          repository: MatrixAI/.github
+          ref: ${{ inputs.ref }}
+          path: tmp/.github
+      - name: Parse Secrets
+        uses: ./tmp/.github/.github/actions/secrets-parse
+        with:
+          secrets: ${{ secrets.DEPLOY_SECRETS }}
+      - uses: actions/checkout@v4
+        with:
+          lfs: true
+      - uses: MatrixAI/.github/.github/actions/matrixai-env-setup@master
+      - name: Setup Deploy Secrets
+        run: |
+          echo "${{ inputs.DEPLOY_SECRETS }}" | jq -r 'to_entries | .[] | "\(.key)=\(.value)"' >> $GITHUB_ENV
+      - name: Run The Test
+        run: |
+          echo "WHAT IS THIS? $ABC_FEATURE AFTER THE ABC_FEATURE"
+          [ -n "$ABC_FEATURE" ] && echo "ABC_MASTER is set and non-empty" || echo "ABC is not set or empty"
+          echo "WHAT IS THIS? $ABC_MASTER AFTER THE ABC_MASTER"
+          [ -n "$ABC_MASTER" ] && echo "ABC_FEATURE is set and non-empty" || echo "ABC is not set or empty"
+
   # Lint the code
   feature-lint:
     name: "Feature / Lint"

From 4b9631bf7ab26f345c68e0f7d5b1850db4dcb100 Mon Sep 17 00:00:00 2001
From: Roger Qiu <roger.qiu@polyhack.io>
Date: Tue, 25 Mar 2025 14:57:52 +1100
Subject: [PATCH 10/34] chore: test the actual values of the 2 variables

---
 .github/workflows/application-js-cloudflare-feature.yml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/.github/workflows/application-js-cloudflare-feature.yml b/.github/workflows/application-js-cloudflare-feature.yml
index d2a94e4..0e79a29 100644
--- a/.github/workflows/application-js-cloudflare-feature.yml
+++ b/.github/workflows/application-js-cloudflare-feature.yml
@@ -54,6 +54,10 @@ jobs:
           [ -n "$ABC_FEATURE" ] && echo "ABC_MASTER is set and non-empty" || echo "ABC is not set or empty"
           echo "WHAT IS THIS? $ABC_MASTER AFTER THE ABC_MASTER"
           [ -n "$ABC_MASTER" ] && echo "ABC_FEATURE is set and non-empty" || echo "ABC is not set or empty"
+          [ "$ABC_MASTER" = "xxx" ] && echo 'ABC_MASTER is xxx'
+          [ "$ABC_MASTER" = "yyy" ] && echo 'ABC_MASTER is yyy'
+          [ "$ABC_FEATURE" = "xxx" ] && echo 'ABC_FEATURE is xxx'
+          [ "$ABC_FEATURE" = "yyy" ] && echo 'ABC_FEATURE is yyy'
 
   # Lint the code
   feature-lint:

From de48b5ae9be1d6bee2ed9d8fc2c95bcaf9527364 Mon Sep 17 00:00:00 2001
From: Roger Qiu <roger.qiu@polyhack.io>
Date: Tue, 25 Mar 2025 15:07:04 +1100
Subject: [PATCH 11/34] chore: no need for testing, environments work

---
 .../application-js-cloudflare-feature.yml     | 35 -------------------
 1 file changed, 35 deletions(-)

diff --git a/.github/workflows/application-js-cloudflare-feature.yml b/.github/workflows/application-js-cloudflare-feature.yml
index 0e79a29..1122c29 100644
--- a/.github/workflows/application-js-cloudflare-feature.yml
+++ b/.github/workflows/application-js-cloudflare-feature.yml
@@ -24,41 +24,6 @@ env:
   NIX_CONFIG: access-tokens = github.com=${{ secrets.NIXPKGS_PRIVATE_PAT }}
 
 jobs:
-  feature-test-secret:
-    name: "Feature / Secret Test"
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-    environment: ${{ inputs.environment }}
-    steps:
-      - name: Checkout Actions
-        uses: actions/checkout@v4
-        with:
-          repository: MatrixAI/.github
-          ref: ${{ inputs.ref }}
-          path: tmp/.github
-      - name: Parse Secrets
-        uses: ./tmp/.github/.github/actions/secrets-parse
-        with:
-          secrets: ${{ secrets.DEPLOY_SECRETS }}
-      - uses: actions/checkout@v4
-        with:
-          lfs: true
-      - uses: MatrixAI/.github/.github/actions/matrixai-env-setup@master
-      - name: Setup Deploy Secrets
-        run: |
-          echo "${{ inputs.DEPLOY_SECRETS }}" | jq -r 'to_entries | .[] | "\(.key)=\(.value)"' >> $GITHUB_ENV
-      - name: Run The Test
-        run: |
-          echo "WHAT IS THIS? $ABC_FEATURE AFTER THE ABC_FEATURE"
-          [ -n "$ABC_FEATURE" ] && echo "ABC_MASTER is set and non-empty" || echo "ABC is not set or empty"
-          echo "WHAT IS THIS? $ABC_MASTER AFTER THE ABC_MASTER"
-          [ -n "$ABC_MASTER" ] && echo "ABC_FEATURE is set and non-empty" || echo "ABC is not set or empty"
-          [ "$ABC_MASTER" = "xxx" ] && echo 'ABC_MASTER is xxx'
-          [ "$ABC_MASTER" = "yyy" ] && echo 'ABC_MASTER is yyy'
-          [ "$ABC_FEATURE" = "xxx" ] && echo 'ABC_FEATURE is xxx'
-          [ "$ABC_FEATURE" = "yyy" ] && echo 'ABC_FEATURE is yyy'
-
   # Lint the code
   feature-lint:
     name: "Feature / Lint"

From 8152f62ccdd339e20cbb455ae69b891f694f73d5 Mon Sep 17 00:00:00 2001
From: Brian Botha <brian.botha@matrix.ai>
Date: Wed, 26 Mar 2025 10:53:11 +1100
Subject: [PATCH 12/34] fix: adding submodule support to native workflows

---
 .github/workflows/native-library-js-feature.yml |  8 ++++++++
 .github/workflows/native-library-js-staging.yml |  9 +++++++++
 .github/workflows/native-library-js-tag.yml     | 10 ++++++++++
 3 files changed, 27 insertions(+)

diff --git a/.github/workflows/native-library-js-feature.yml b/.github/workflows/native-library-js-feature.yml
index 7a2e41a..a3975ce 100644
--- a/.github/workflows/native-library-js-feature.yml
+++ b/.github/workflows/native-library-js-feature.yml
@@ -12,6 +12,8 @@ jobs:
       contents: read
     steps:
       - uses: actions/checkout@v4
+        with:
+          submodules: 'recursive'
       - uses: MatrixAI/.github/.github/actions/matrixai-env-setup@master
       - name: Run linting
         run: |
@@ -28,6 +30,8 @@ jobs:
       actions: write
     steps:
       - uses: actions/checkout@v4
+        with:
+          submodules: 'recursive'
       - uses: MatrixAI/.github/.github/actions/matrixai-env-setup@master
       - name: Run build
         run: |
@@ -50,6 +54,8 @@ jobs:
       checks: write
     steps:
       - uses: actions/checkout@v4
+        with:
+          submodules: 'recursive'
       - uses: MatrixAI/.github/.github/actions/matrixai-env-setup@master
       - name: Run tests
         run: |
@@ -82,6 +88,8 @@ jobs:
       actions: write
     steps:
       - uses: actions/checkout@v4
+        with:
+          submodules: 'recursive'
       - uses: MatrixAI/.github/.github/actions/matrixai-env-setup@master
       - name: Run bench
         run: |
diff --git a/.github/workflows/native-library-js-staging.yml b/.github/workflows/native-library-js-staging.yml
index 9872d34..06eb43e 100644
--- a/.github/workflows/native-library-js-staging.yml
+++ b/.github/workflows/native-library-js-staging.yml
@@ -23,6 +23,8 @@ jobs:
       contents: read
     steps:
       - uses: actions/checkout@v4
+        with:
+          submodules: 'recursive'
       - uses: MatrixAI/.github/.github/actions/matrixai-env-setup@master
       - name: Run linting
         run: |
@@ -40,6 +42,8 @@ jobs:
       pull-requests: write
     steps:
       - uses: actions/checkout@v4
+        with:
+          submodules: 'recursive'
       - name: Create Pull Request from Staging to Master
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -64,6 +68,8 @@ jobs:
       actions: write
     steps:
       - uses: actions/checkout@v4
+        with:
+          submodules: 'recursive'
       - uses: MatrixAI/.github/.github/actions/matrixai-env-setup@master
       - name: Run build
         run: |
@@ -129,6 +135,8 @@ jobs:
               npm run bench --if-present
     steps:
       - uses: actions/checkout@v4
+        with:
+          submodules: 'recursive'
       - if: matrix.platform == 'linux'
         uses: MatrixAI/.github/.github/actions/matrixai-env-setup@master
       - uses: actions/download-artifact@v4
@@ -181,6 +189,7 @@ jobs:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
+          submodules: 'recursive'
           token: ${{ secrets.GH_TOKEN }}
       - name: Merge Pull Request from Staging to Master
         env:
diff --git a/.github/workflows/native-library-js-tag.yml b/.github/workflows/native-library-js-tag.yml
index a696ce8..bb9b8bd 100644
--- a/.github/workflows/native-library-js-tag.yml
+++ b/.github/workflows/native-library-js-tag.yml
@@ -16,6 +16,8 @@ jobs:
       actions: write
     steps:
       - uses: actions/checkout@v4
+        with:
+          submodules: 'recursive'
       - uses: MatrixAI/.github/.github/actions/matrixai-env-setup@master
       - name: Run linting
         run: |
@@ -34,6 +36,8 @@ jobs:
     needs: tag-lint
     steps:
       - uses: actions/checkout@v4
+        with:
+          submodules: 'recursive'
       - uses: MatrixAI/.github/.github/actions/matrixai-env-setup@master
       - name: Run build
         run: |
@@ -106,6 +110,8 @@ jobs:
               npm run bench
     steps:
       - uses: actions/checkout@v4
+        with:
+          submodules: 'recursive'
       - if: matrix.platform == 'linux'
         uses: MatrixAI/.github/.github/actions/matrixai-env-setup@master
       - uses: actions/setup-node@v4
@@ -138,6 +144,8 @@ jobs:
     if: startsWith(github.ref, 'refs/tags/v') && contains(github.ref, '-')
     steps:
       - uses: actions/checkout@v4
+        with:
+          submodules: 'recursive'
       - uses: MatrixAI/.github/.github/actions/matrixai-env-setup@master
       - uses: actions/download-artifact@v4
         with:
@@ -190,6 +198,8 @@ jobs:
     if: startsWith(github.ref, 'refs/tags/v') && !contains(github.ref, '-')
     steps:
       - uses: actions/checkout@v4
+        with:
+          submodules: 'recursive'
       - uses: MatrixAI/.github/.github/actions/matrixai-env-setup@master
       - uses: actions/download-artifact@v4
         with:

From 831e718c033cb14055a518ea68902365798df28e Mon Sep 17 00:00:00 2001
From: Brian Botha <brian.botha@matrix.ai>
Date: Wed, 26 Mar 2025 11:03:49 +1100
Subject: [PATCH 13/34] fix: disabling fail-fast for native workflows

---
 .github/workflows/native-library-js-staging.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/native-library-js-staging.yml b/.github/workflows/native-library-js-staging.yml
index 06eb43e..fdc8239 100644
--- a/.github/workflows/native-library-js-staging.yml
+++ b/.github/workflows/native-library-js-staging.yml
@@ -94,7 +94,7 @@ jobs:
       actions: write
       checks: write
     strategy:
-      fail-fast: true
+      fail-fast: false
       matrix:
         include:
           - platform: linux

From ec8ea669c54464e6b37ea7b5ebe12a5eda3a9640 Mon Sep 17 00:00:00 2001
From: Brynley Llewellyn-Roux <blynblack@gmail.com>
Date: Thu, 27 Mar 2025 08:59:03 +1100
Subject: [PATCH 14/34] fix: force `prebuild` folder name

---
 .github/workflows/native-library-js-tag.yml | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/native-library-js-tag.yml b/.github/workflows/native-library-js-tag.yml
index bb9b8bd..3dd3115 100644
--- a/.github/workflows/native-library-js-tag.yml
+++ b/.github/workflows/native-library-js-tag.yml
@@ -70,7 +70,7 @@ jobs:
               RUST_BACKTRACE: "1"
             script: |
               nix develop .#ci --command bash -c $'
-              npm run prebuild --verbose -- --production
+              npm run prebuild --verbose -- --production --output=prebuild
               npm test -- --ci --coverage
               npm run bench
               '
@@ -87,7 +87,7 @@ jobs:
               refreshenv
               npm install --ignore-scripts
               $env:Path = "$(npm root)\.bin;" + $env:Path
-              npm run prebuild --verbose -- --production
+              npm run prebuild --verbose -- --production --output=prebuild
               npm test -- --ci --coverage
               npm run bench
           - platform: macos
@@ -102,8 +102,8 @@ jobs:
               npm install --ignore-scripts
               export PATH="$(npm root)/.bin:$PATH"
               export PATH="$HOME/.cargo/bin:$PATH"
-              npm run prebuild --verbose -- --arch x64 --production
-              npm run prebuild --verbose -- --arch arm64 --production
+              npm run prebuild --verbose -- --arch x64 --production --output=prebuild
+              npm run prebuild --verbose -- --arch arm64 --production --output=prebuild
               lipo -create -output prebuild/quic-darwin-x64+arm64.node prebuild/quic-darwin-arm64.node prebuild/quic-darwin-x64.node
               rm -rf node_modules/@matrixai/quic-*
               npm test -- --ci --coverage

From f267c2fd469a0777f09d545c4dd177c5f60bff14 Mon Sep 17 00:00:00 2001
From: Brynley Llewellyn-Roux <blynblack@gmail.com>
Date: Thu, 27 Mar 2025 09:05:51 +1100
Subject: [PATCH 15/34] Revert "fix: force `prebuild` folder name"

This reverts commit ec8ea669c54464e6b37ea7b5ebe12a5eda3a9640.
---
 .github/workflows/native-library-js-tag.yml | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/native-library-js-tag.yml b/.github/workflows/native-library-js-tag.yml
index 3dd3115..bb9b8bd 100644
--- a/.github/workflows/native-library-js-tag.yml
+++ b/.github/workflows/native-library-js-tag.yml
@@ -70,7 +70,7 @@ jobs:
               RUST_BACKTRACE: "1"
             script: |
               nix develop .#ci --command bash -c $'
-              npm run prebuild --verbose -- --production --output=prebuild
+              npm run prebuild --verbose -- --production
               npm test -- --ci --coverage
               npm run bench
               '
@@ -87,7 +87,7 @@ jobs:
               refreshenv
               npm install --ignore-scripts
               $env:Path = "$(npm root)\.bin;" + $env:Path
-              npm run prebuild --verbose -- --production --output=prebuild
+              npm run prebuild --verbose -- --production
               npm test -- --ci --coverage
               npm run bench
           - platform: macos
@@ -102,8 +102,8 @@ jobs:
               npm install --ignore-scripts
               export PATH="$(npm root)/.bin:$PATH"
               export PATH="$HOME/.cargo/bin:$PATH"
-              npm run prebuild --verbose -- --arch x64 --production --output=prebuild
-              npm run prebuild --verbose -- --arch arm64 --production --output=prebuild
+              npm run prebuild --verbose -- --arch x64 --production
+              npm run prebuild --verbose -- --arch arm64 --production
               lipo -create -output prebuild/quic-darwin-x64+arm64.node prebuild/quic-darwin-arm64.node prebuild/quic-darwin-x64.node
               rm -rf node_modules/@matrixai/quic-*
               npm test -- --ci --coverage

From 61ecbd292ae0b67903d97aae1779337e79ac7600 Mon Sep 17 00:00:00 2001
From: Brynley Llewellyn-Roux <blynblack@gmail.com>
Date: Thu, 27 Mar 2025 09:31:16 +1100
Subject: [PATCH 16/34] fix: separate rust and gyp workflows

---
 .../workflows/native-library-js-tag-gyp.yml   | 238 ++++++++++++++++++
 ...tag.yml => native-library-js-tag-rust.yml} |   0
 2 files changed, 238 insertions(+)
 create mode 100644 .github/workflows/native-library-js-tag-gyp.yml
 rename .github/workflows/{native-library-js-tag.yml => native-library-js-tag-rust.yml} (100%)

diff --git a/.github/workflows/native-library-js-tag-gyp.yml b/.github/workflows/native-library-js-tag-gyp.yml
new file mode 100644
index 0000000..00785df
--- /dev/null
+++ b/.github/workflows/native-library-js-tag-gyp.yml
@@ -0,0 +1,238 @@
+name: "CI / Library JS Tag"
+
+on:
+  workflow_call:
+    secrets:
+      NPM_TOKEN:
+        required: true
+
+jobs:
+  # Lint the code
+  tag-lint:
+    name: "Tag / Lint"
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      actions: write
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          submodules: 'recursive'
+      - uses: MatrixAI/.github/.github/actions/matrixai-env-setup@master
+      - name: Run linting
+        run: |
+          nix develop .#ci --command bash -c $'
+          npm run lint
+          npm run lint-shell
+          '
+
+  # Build the distribution - JS is platform-agnostic
+  tag-build:
+    name: "Tag / Build"
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      actions: write
+    needs: tag-lint
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          submodules: 'recursive'
+      - uses: MatrixAI/.github/.github/actions/matrixai-env-setup@master
+      - name: Run build
+        run: |
+          nix develop .#ci --command bash -c $'
+          npm run build --verbose
+          '
+      - name: Upload Build
+        uses: actions/upload-artifact@v4
+        with:
+          name: dist
+          path: ./dist
+
+  tag-platforms:
+    name: "Tag / Platforms"
+    needs:
+      - tag-build
+    runs-on: ${{ matrix.os }}
+    permissions:
+      contents: read
+      actions: write
+      checks: write
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - platform: linux
+            os: ubuntu-latest
+            env:
+              npm_config_arch: "x64"
+              RUST_BACKTRACE: "1"
+            script: |
+              nix develop .#ci --command bash -c $'
+              npm run prebuild --verbose -- --production
+              npm test -- --ci --coverage
+              npm run bench
+              '
+          - platform: windows
+            os: windows-latest
+            env:
+              npm_config_arch: "x64"
+              RUST_BACKTRACE: "1"
+              LIBCLANG_PATH: "C:\\Program Files\\LLVM\\bin"
+            script: |
+              mkdir -Force "$CI_PROJECT_DIR/tmp"
+              Import-Module $env:ChocolateyInstall\helpers\chocolateyProfile.psm1
+              ./scripts/choco-install.ps1
+              refreshenv
+              npm install --ignore-scripts
+              $env:Path = "$(npm root)\.bin;" + $env:Path
+              npm run prebuild --verbose -- --production
+              npm test -- --ci --coverage
+              npm run bench
+          - platform: macos
+            os: macos-latest
+            env:
+              RUST_BACKTRACE: "1"
+            script: |
+              eval "$(brew shellenv)"
+              ./scripts/brew-install.sh
+              export PYTHON=$(brew --prefix python@3.10)/bin/python3.10
+              hash -r
+              npm install --ignore-scripts
+              export PATH="$(npm root)/.bin:$PATH"
+              export PATH="$HOME/.cargo/bin:$PATH"
+              npm run prebuild --verbose -- --arch x64 --production
+              npm run prebuild --verbose -- --arch arm64 --production
+              lipo -create -output prebuilds/quic-darwin-x64+arm64.node prebuilds/quic-darwin-arm64.node prebuilds/quic-darwin-x64.node
+              rm -rf node_modules/@matrixai/quic-*
+              npm test -- --ci --coverage
+              npm run bench
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          submodules: 'recursive'
+      - if: matrix.platform == 'linux'
+        uses: MatrixAI/.github/.github/actions/matrixai-env-setup@master
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+      - uses: actions/download-artifact@v4
+        with:
+          name: dist
+          path: ./dist
+      - name: Build
+        env: ${{ matrix.env }}
+        run: ${{ matrix.script }}
+      - uses: actions/upload-artifact@v4
+        with:
+          name: prebuild-${{ matrix.platform }}
+          path: ./prebuilds
+
+
+  # Publish the prerelease
+  tag-prerelease:
+    name: "Tag / Pre-release"
+    runs-on: ubuntu-latest
+    concurrency:
+      group: tag-prerelease
+      cancel-in-progress: false
+    needs:
+      - tag-platforms
+    permissions:
+      contents: write
+    if: startsWith(github.ref, 'refs/tags/v') && contains(github.ref, '-')
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          submodules: 'recursive'
+      - uses: MatrixAI/.github/.github/actions/matrixai-env-setup@master
+      - uses: actions/download-artifact@v4
+        with:
+          pattern: prebuild*
+          path: prebuilds
+          merge-multiple: true
+      - name: Publishing library prerelease
+        env:
+          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          echo "//registry.npmjs.org/:_authToken=$NPM_TOKEN" > ./.npmrc
+          nix develop .#ci --command bash -c $'
+          npm publish --tag prerelease --access public
+          '
+          for d in prebuilds/*; do
+            tar \
+              --create \
+              --verbose \
+              --file="prebuilds/$(basename $d).tar" \
+              --directory=prebuilds \
+              "$(basename $d)"
+          done
+          nix develop .#ci --command bash -c $'
+          gh release \
+            create "$GITHUB_REF_NAME" \
+            prebuilds/*.tar \
+            --title "$GITHUB_REF_NAME-$(date -u +"%Y-%m-%dT%H:%M:%SZ")" \
+            --notes "" \
+            --prerelease \
+            --target staging \
+            --repo "$GITHUB_REPOSITORY"
+          '
+      - name: Remove `.npmrc`
+        if: success() || failure()
+        run: |
+          rm -f ./.npmrc
+
+  # Publish the release
+  tag-release:
+    name: "Tag / Release"
+    runs-on: ubuntu-latest
+    concurrency:
+      group: tag-release
+      cancel-in-progress: false
+    needs:
+      - tag-platforms
+    permissions:
+      contents: write
+    if: startsWith(github.ref, 'refs/tags/v') && !contains(github.ref, '-')
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          submodules: 'recursive'
+      - uses: MatrixAI/.github/.github/actions/matrixai-env-setup@master
+      - uses: actions/download-artifact@v4
+        with:
+          pattern: prebuild*
+          path: prebuilds
+          merge-multiple: true
+      - name: Publishing library release
+        env:
+          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          echo "//registry.npmjs.org/:_authToken=$NPM_TOKEN" > ./.npmrc
+          nix develop .#ci --command bash -c $'
+          npm publish --access public
+          '
+          for d in prebuilds/*; do
+            tar \
+              --create \
+              --verbose \
+              --file="prebuilds/$(basename $d).tar" \
+              --directory=prebuilds \
+              "$(basename $d)"
+          done
+          nix develop .#ci --command bash -c $'
+          gh release \
+            create "$GITHUB_REF_NAME" \
+            prebuilds/*.tar \
+            --title "$GITHUB_REF_NAME-$(date -u +"%Y-%m-%dT%H:%M:%SZ")" \
+            --notes "" \
+            --target master \
+            --repo "$GITHUB_REPOSITORY"
+          '
+      - name: Remove `.npmrc`
+        if: success() || failure()
+        run: |
+          rm -f ./.npmrc
diff --git a/.github/workflows/native-library-js-tag.yml b/.github/workflows/native-library-js-tag-rust.yml
similarity index 100%
rename from .github/workflows/native-library-js-tag.yml
rename to .github/workflows/native-library-js-tag-rust.yml

From a31afbca0fb68dadeaf934b16169ae9050d056d7 Mon Sep 17 00:00:00 2001
From: Brian Botha <brian.botha@matrix.ai>
Date: Thu, 27 Mar 2025 09:40:28 +1100
Subject: [PATCH 17/34] fix: renamed `native-libray-js-tag-rust.ymp` back to
 `native-libray-js-tag.ymp`

---
 .../{native-library-js-tag-rust.yml => native-library-js-tag.yml} | 0
 1 file changed, 0 insertions(+), 0 deletions(-)
 rename .github/workflows/{native-library-js-tag-rust.yml => native-library-js-tag.yml} (100%)

diff --git a/.github/workflows/native-library-js-tag-rust.yml b/.github/workflows/native-library-js-tag.yml
similarity index 100%
rename from .github/workflows/native-library-js-tag-rust.yml
rename to .github/workflows/native-library-js-tag.yml

From 45a465d91999abce71fddce2a1e7ab4d336b9f1f Mon Sep 17 00:00:00 2001
From: Brynley Llewellyn-Roux <blynblack@gmail.com>
Date: Thu, 27 Mar 2025 10:00:29 +1100
Subject: [PATCH 18/34] fix: remove rust from gyp macos workflow

---
 .github/workflows/native-library-js-tag-gyp.yml | 8 +-------
 1 file changed, 1 insertion(+), 7 deletions(-)

diff --git a/.github/workflows/native-library-js-tag-gyp.yml b/.github/workflows/native-library-js-tag-gyp.yml
index 00785df..b34f32f 100644
--- a/.github/workflows/native-library-js-tag-gyp.yml
+++ b/.github/workflows/native-library-js-tag-gyp.yml
@@ -92,8 +92,6 @@ jobs:
               npm run bench
           - platform: macos
             os: macos-latest
-            env:
-              RUST_BACKTRACE: "1"
             script: |
               eval "$(brew shellenv)"
               ./scripts/brew-install.sh
@@ -101,11 +99,7 @@ jobs:
               hash -r
               npm install --ignore-scripts
               export PATH="$(npm root)/.bin:$PATH"
-              export PATH="$HOME/.cargo/bin:$PATH"
-              npm run prebuild --verbose -- --arch x64 --production
-              npm run prebuild --verbose -- --arch arm64 --production
-              lipo -create -output prebuilds/quic-darwin-x64+arm64.node prebuilds/quic-darwin-arm64.node prebuilds/quic-darwin-x64.node
-              rm -rf node_modules/@matrixai/quic-*
+              npm run prebuild --verbose -- --production
               npm test -- --ci --coverage
               npm run bench
     steps:

From e4e1e6cd38de052e87aaee46471cfc7d76cba1c8 Mon Sep 17 00:00:00 2001
From: Brynley Llewellyn-Roux <blynblack@gmail.com>
Date: Thu, 27 Mar 2025 10:12:04 +1100
Subject: [PATCH 19/34] fix: add env to macos job

---
 .github/workflows/native-library-js-tag-gyp.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/native-library-js-tag-gyp.yml b/.github/workflows/native-library-js-tag-gyp.yml
index b34f32f..38b60e6 100644
--- a/.github/workflows/native-library-js-tag-gyp.yml
+++ b/.github/workflows/native-library-js-tag-gyp.yml
@@ -92,6 +92,7 @@ jobs:
               npm run bench
           - platform: macos
             os: macos-latest
+            env: {}
             script: |
               eval "$(brew shellenv)"
               ./scripts/brew-install.sh

From eb48b7da8343285da3f5272ae292f1cbba08553e Mon Sep 17 00:00:00 2001
From: Roger Qiu <roger.qiu@polyhack.io>
Date: Thu, 27 Mar 2025 22:13:24 +1100
Subject: [PATCH 20/34] fix: left some echoing of irrelevant variables

---
 .github/workflows/application-js-cloudflare-feature.yml | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/.github/workflows/application-js-cloudflare-feature.yml b/.github/workflows/application-js-cloudflare-feature.yml
index 1122c29..3cf4a3a 100644
--- a/.github/workflows/application-js-cloudflare-feature.yml
+++ b/.github/workflows/application-js-cloudflare-feature.yml
@@ -121,9 +121,6 @@ jobs:
           url: "https://${{ github.ref_name }}.dev.zeta.house"
         run: |
           echo 'Perform service deployment for feature'
-          echo "$SECRET1"
-          echo "$SECRET2"
-          echo "$SECRET3"
           nix develop .#ci --command bash -c $'
           npm run deploy -- \
             --feature "$GITHUB_REF_NAME" \

From 720925292dec90577577adda49dbda0c2beb401a Mon Sep 17 00:00:00 2001
From: Roger Qiu <roger.qiu@polyhack.io>
Date: Thu, 27 Mar 2025 22:13:53 +1100
Subject: [PATCH 21/34] fix: automatic staging PRs should be assigned to the
 bot itself

---
 .github/workflows/application-js-cloudflare-staging.yml | 1 +
 .github/workflows/application-js-staging.yml            | 1 +
 .github/workflows/library-js-staging.yml                | 1 +
 .github/workflows/native-library-js-staging.yml         | 1 +
 4 files changed, 4 insertions(+)

diff --git a/.github/workflows/application-js-cloudflare-staging.yml b/.github/workflows/application-js-cloudflare-staging.yml
index 60cc507..137a418 100644
--- a/.github/workflows/application-js-cloudflare-staging.yml
+++ b/.github/workflows/application-js-cloudflare-staging.yml
@@ -68,6 +68,7 @@ jobs:
           gh pr create \
             --head staging \
             --base master \
+            --assign '@me' \
             --title "ci: merge staging to master" \
             --body "This is an automatic PR generated by the CI/CD pipeline. This will be automatically fast-forward merged if successful." \
             --no-maintainer-edit || true
diff --git a/.github/workflows/application-js-staging.yml b/.github/workflows/application-js-staging.yml
index 5e9bdce..44be975 100644
--- a/.github/workflows/application-js-staging.yml
+++ b/.github/workflows/application-js-staging.yml
@@ -66,6 +66,7 @@ jobs:
           gh pr create \
             --head staging \
             --base master \
+            --assign '@me' \
             --title "ci: merge staging to master" \
             --body "This is an automatic PR generated by the CI/CD pipeline. This will be automatically fast-forward merged if successful." \
             --no-maintainer-edit || true
diff --git a/.github/workflows/library-js-staging.yml b/.github/workflows/library-js-staging.yml
index 71675ef..782721d 100644
--- a/.github/workflows/library-js-staging.yml
+++ b/.github/workflows/library-js-staging.yml
@@ -46,6 +46,7 @@ jobs:
           gh pr create \
             --head staging \
             --base master \
+            --assign '@me' \
             --title "ci: merge staging to master" \
             --body "This is an automatic PR generated by the CI/CD pipeline. This will be automatically fast-forward merged if successful." \
             --no-maintainer-edit || true
diff --git a/.github/workflows/native-library-js-staging.yml b/.github/workflows/native-library-js-staging.yml
index fdc8239..2935725 100644
--- a/.github/workflows/native-library-js-staging.yml
+++ b/.github/workflows/native-library-js-staging.yml
@@ -51,6 +51,7 @@ jobs:
           gh pr create \
             --head staging \
             --base master \
+            --assign '@me' \
             --title "ci: merge staging to master" \
             --body "This is an automatic PR generated by the CI/CD pipeline. This will be automatically fast-forward merged if successful." \
             --no-maintainer-edit || true

From 7e890c322f2da11be68787e2cf6f290481ebefe2 Mon Sep 17 00:00:00 2001
From: Roger Qiu <roger.qiu@polyhack.io>
Date: Thu, 27 Mar 2025 22:16:26 +1100
Subject: [PATCH 22/34] fix: the `--assign` should be `--assignee`

---
 .github/workflows/application-js-cloudflare-staging.yml | 2 +-
 .github/workflows/application-js-staging.yml            | 2 +-
 .github/workflows/library-js-staging.yml                | 2 +-
 .github/workflows/native-library-js-staging.yml         | 2 +-
 4 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/application-js-cloudflare-staging.yml b/.github/workflows/application-js-cloudflare-staging.yml
index 137a418..3ac23b7 100644
--- a/.github/workflows/application-js-cloudflare-staging.yml
+++ b/.github/workflows/application-js-cloudflare-staging.yml
@@ -68,7 +68,7 @@ jobs:
           gh pr create \
             --head staging \
             --base master \
-            --assign '@me' \
+            --assignee '@me' \
             --title "ci: merge staging to master" \
             --body "This is an automatic PR generated by the CI/CD pipeline. This will be automatically fast-forward merged if successful." \
             --no-maintainer-edit || true
diff --git a/.github/workflows/application-js-staging.yml b/.github/workflows/application-js-staging.yml
index 44be975..9c7a322 100644
--- a/.github/workflows/application-js-staging.yml
+++ b/.github/workflows/application-js-staging.yml
@@ -66,7 +66,7 @@ jobs:
           gh pr create \
             --head staging \
             --base master \
-            --assign '@me' \
+            --assignee '@me' \
             --title "ci: merge staging to master" \
             --body "This is an automatic PR generated by the CI/CD pipeline. This will be automatically fast-forward merged if successful." \
             --no-maintainer-edit || true
diff --git a/.github/workflows/library-js-staging.yml b/.github/workflows/library-js-staging.yml
index 782721d..3513ba5 100644
--- a/.github/workflows/library-js-staging.yml
+++ b/.github/workflows/library-js-staging.yml
@@ -46,7 +46,7 @@ jobs:
           gh pr create \
             --head staging \
             --base master \
-            --assign '@me' \
+            --assignee '@me' \
             --title "ci: merge staging to master" \
             --body "This is an automatic PR generated by the CI/CD pipeline. This will be automatically fast-forward merged if successful." \
             --no-maintainer-edit || true
diff --git a/.github/workflows/native-library-js-staging.yml b/.github/workflows/native-library-js-staging.yml
index 2935725..9c6689e 100644
--- a/.github/workflows/native-library-js-staging.yml
+++ b/.github/workflows/native-library-js-staging.yml
@@ -51,7 +51,7 @@ jobs:
           gh pr create \
             --head staging \
             --base master \
-            --assign '@me' \
+            --assignee '@me' \
             --title "ci: merge staging to master" \
             --body "This is an automatic PR generated by the CI/CD pipeline. This will be automatically fast-forward merged if successful." \
             --no-maintainer-edit || true

From 337bca061c3ebbb097e2eff3857b36c07c301a68 Mon Sep 17 00:00:00 2001
From: Roger Qiu <roger.qiu@polyhack.io>
Date: Tue, 1 Apr 2025 21:08:39 +1100
Subject: [PATCH 23/34] fix: revert using `--assignee` cause it does not work
 with the github-actions[bot]

---
 .github/workflows/application-js-cloudflare-staging.yml | 1 -
 .github/workflows/application-js-staging.yml            | 1 -
 .github/workflows/library-js-staging.yml                | 1 -
 .github/workflows/native-library-js-staging.yml         | 1 -
 4 files changed, 4 deletions(-)

diff --git a/.github/workflows/application-js-cloudflare-staging.yml b/.github/workflows/application-js-cloudflare-staging.yml
index 3ac23b7..60cc507 100644
--- a/.github/workflows/application-js-cloudflare-staging.yml
+++ b/.github/workflows/application-js-cloudflare-staging.yml
@@ -68,7 +68,6 @@ jobs:
           gh pr create \
             --head staging \
             --base master \
-            --assignee '@me' \
             --title "ci: merge staging to master" \
             --body "This is an automatic PR generated by the CI/CD pipeline. This will be automatically fast-forward merged if successful." \
             --no-maintainer-edit || true
diff --git a/.github/workflows/application-js-staging.yml b/.github/workflows/application-js-staging.yml
index 9c7a322..5e9bdce 100644
--- a/.github/workflows/application-js-staging.yml
+++ b/.github/workflows/application-js-staging.yml
@@ -66,7 +66,6 @@ jobs:
           gh pr create \
             --head staging \
             --base master \
-            --assignee '@me' \
             --title "ci: merge staging to master" \
             --body "This is an automatic PR generated by the CI/CD pipeline. This will be automatically fast-forward merged if successful." \
             --no-maintainer-edit || true
diff --git a/.github/workflows/library-js-staging.yml b/.github/workflows/library-js-staging.yml
index 3513ba5..71675ef 100644
--- a/.github/workflows/library-js-staging.yml
+++ b/.github/workflows/library-js-staging.yml
@@ -46,7 +46,6 @@ jobs:
           gh pr create \
             --head staging \
             --base master \
-            --assignee '@me' \
             --title "ci: merge staging to master" \
             --body "This is an automatic PR generated by the CI/CD pipeline. This will be automatically fast-forward merged if successful." \
             --no-maintainer-edit || true
diff --git a/.github/workflows/native-library-js-staging.yml b/.github/workflows/native-library-js-staging.yml
index 9c6689e..fdc8239 100644
--- a/.github/workflows/native-library-js-staging.yml
+++ b/.github/workflows/native-library-js-staging.yml
@@ -51,7 +51,6 @@ jobs:
           gh pr create \
             --head staging \
             --base master \
-            --assignee '@me' \
             --title "ci: merge staging to master" \
             --body "This is an automatic PR generated by the CI/CD pipeline. This will be automatically fast-forward merged if successful." \
             --no-maintainer-edit || true

From 47a2c588fa6107b27191feef207ec6cf991e347b Mon Sep 17 00:00:00 2001
From: Brian Botha <brian.botha@matrix.ai>
Date: Tue, 15 Apr 2025 08:11:35 +1000
Subject: [PATCH 24/34] test: running check for native tag workflow

---
 .github/workflows/native-library-js-tag.yml | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/.github/workflows/native-library-js-tag.yml b/.github/workflows/native-library-js-tag.yml
index bb9b8bd..e16f8bc 100644
--- a/.github/workflows/native-library-js-tag.yml
+++ b/.github/workflows/native-library-js-tag.yml
@@ -104,6 +104,11 @@ jobs:
               export PATH="$HOME/.cargo/bin:$PATH"
               npm run prebuild --verbose -- --arch x64 --production
               npm run prebuild --verbose -- --arch arm64 --production
+              echo "checking prebuild files"
+              ls prebuild
+              echo "checking lipo help"
+              lipo --help
+              echo "running lipo"
               lipo -create -output prebuild/quic-darwin-x64+arm64.node prebuild/quic-darwin-arm64.node prebuild/quic-darwin-x64.node
               rm -rf node_modules/@matrixai/quic-*
               npm test -- --ci --coverage

From bb7e9b5628a328531e32fc69157a255a98664bd0 Mon Sep 17 00:00:00 2001
From: Brian Botha <brian.botha@matrix.ai>
Date: Tue, 15 Apr 2025 09:04:46 +1000
Subject: [PATCH 25/34] fix: quick fix for exec ci release

---
 .github/workflows/native-library-js-tag.yml | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/native-library-js-tag.yml b/.github/workflows/native-library-js-tag.yml
index e16f8bc..73f6696 100644
--- a/.github/workflows/native-library-js-tag.yml
+++ b/.github/workflows/native-library-js-tag.yml
@@ -102,16 +102,16 @@ jobs:
               npm install --ignore-scripts
               export PATH="$(npm root)/.bin:$PATH"
               export PATH="$HOME/.cargo/bin:$PATH"
+              echo "Prebuilding for darwin-x64"
               npm run prebuild --verbose -- --arch x64 --production
+              echo "Prebuilding for darwin-arm64"
               npm run prebuild --verbose -- --arch arm64 --production
-              echo "checking prebuild files"
-              ls prebuild
-              echo "checking lipo help"
-              lipo --help
-              echo "running lipo"
-              lipo -create -output prebuild/quic-darwin-x64+arm64.node prebuild/quic-darwin-arm64.node prebuild/quic-darwin-x64.node
-              rm -rf node_modules/@matrixai/quic-*
+              echo "Creating universal binary"
+              lipo -create -output prebuild/exec-darwin-x64+arm64.node prebuild/exec-darwin-arm64.node prebuild/exec-darwin-x64.node
+              rm -rf node_modules/@matrixai/exec-*
+              echo "Running tests"
               npm test -- --ci --coverage
+              echo "Running benchmarks"
               npm run bench
     steps:
       - uses: actions/checkout@v4

From 7840f6fe3062f9bbee42659da4756b11af5fe88c Mon Sep 17 00:00:00 2001
From: Brian Botha <brian.botha@matrix.ai>
Date: Tue, 15 Apr 2025 09:24:58 +1000
Subject: [PATCH 26/34] fix: reverting temp fix

---
 .github/workflows/native-library-js-tag.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/native-library-js-tag.yml b/.github/workflows/native-library-js-tag.yml
index 73f6696..0b47bb1 100644
--- a/.github/workflows/native-library-js-tag.yml
+++ b/.github/workflows/native-library-js-tag.yml
@@ -107,8 +107,8 @@ jobs:
               echo "Prebuilding for darwin-arm64"
               npm run prebuild --verbose -- --arch arm64 --production
               echo "Creating universal binary"
-              lipo -create -output prebuild/exec-darwin-x64+arm64.node prebuild/exec-darwin-arm64.node prebuild/exec-darwin-x64.node
-              rm -rf node_modules/@matrixai/exec-*
+              lipo -create -output prebuild/quic-darwin-x64+arm64.node prebuild/quic-darwin-arm64.node prebuild/quic-darwin-x64.node
+              rm -rf node_modules/@matrixai/quic-*
               echo "Running tests"
               npm test -- --ci --coverage
               echo "Running benchmarks"

From cd2e9a3db0bbca14feefd5038f02076c8b94a39a Mon Sep 17 00:00:00 2001
From: Brynley Llewellyn-Roux <blynblack@gmail.com>
Date: Tue, 15 Apr 2025 11:35:58 +1000
Subject: [PATCH 27/34] fix: use globbing for prebuilds during lipo step

---
 .github/workflows/native-library-js-tag.yml | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/native-library-js-tag.yml b/.github/workflows/native-library-js-tag.yml
index 0b47bb1..0af340e 100644
--- a/.github/workflows/native-library-js-tag.yml
+++ b/.github/workflows/native-library-js-tag.yml
@@ -107,8 +107,14 @@ jobs:
               echo "Prebuilding for darwin-arm64"
               npm run prebuild --verbose -- --arch arm64 --production
               echo "Creating universal binary"
-              lipo -create -output prebuild/quic-darwin-x64+arm64.node prebuild/quic-darwin-arm64.node prebuild/quic-darwin-x64.node
-              rm -rf node_modules/@matrixai/quic-*
+              for f in prebuild/*-darwin-arm64.node; do
+                prefix=$(basename "$f" | sed -E 's/-darwin-arm64\.node$//')
+                lipo -create \
+                  -output "prebuild/${prefix}-darwin-x64+arm64.node" \
+                  "prebuild/${prefix}-darwin-arm64.node" \
+                  "prebuild/${prefix}-darwin-x64.node"
+              done
+              rm -rf node_modules/@matrixai/*-*
               echo "Running tests"
               npm test -- --ci --coverage
               echo "Running benchmarks"

From 6a02d56fd5a2dd2c37a914fdc3dbe5ceb1644bac Mon Sep 17 00:00:00 2001
From: Aryan Jassal <aryan.jassal@matrix.ai>
Date: Wed, 21 May 2025 11:40:18 +1000
Subject: [PATCH 28/34] chore: remove lint-shell from ci lint step

With the introduction of `@matrixai/lint`, the `lint` script handles shell check as well. Thus, the lint-shell script is now redundant.
---
 .github/workflows/native-library-js-staging.yml | 1 -
 .github/workflows/native-library-js-tag-gyp.yml | 1 -
 .github/workflows/native-library-js-tag.yml     | 1 -
 3 files changed, 3 deletions(-)

diff --git a/.github/workflows/native-library-js-staging.yml b/.github/workflows/native-library-js-staging.yml
index fdc8239..1637b0c 100644
--- a/.github/workflows/native-library-js-staging.yml
+++ b/.github/workflows/native-library-js-staging.yml
@@ -30,7 +30,6 @@ jobs:
         run: |
           nix develop .#ci --command bash -c $'
           npm run lint
-          npm run lint-shell
           '
 
   # Create the merge PR
diff --git a/.github/workflows/native-library-js-tag-gyp.yml b/.github/workflows/native-library-js-tag-gyp.yml
index 38b60e6..fe95d44 100644
--- a/.github/workflows/native-library-js-tag-gyp.yml
+++ b/.github/workflows/native-library-js-tag-gyp.yml
@@ -23,7 +23,6 @@ jobs:
         run: |
           nix develop .#ci --command bash -c $'
           npm run lint
-          npm run lint-shell
           '
 
   # Build the distribution - JS is platform-agnostic
diff --git a/.github/workflows/native-library-js-tag.yml b/.github/workflows/native-library-js-tag.yml
index 0af340e..6b239e9 100644
--- a/.github/workflows/native-library-js-tag.yml
+++ b/.github/workflows/native-library-js-tag.yml
@@ -23,7 +23,6 @@ jobs:
         run: |
           nix develop .#ci --command bash -c $'
           npm run lint
-          npm run lint-shell
           '
 
   # Build the distribution - JS is platform-agnostic

From 1de04a2be70bdc6827f84888258504d6e5ab28df Mon Sep 17 00:00:00 2001
From: Brynley Llewellyn-Roux <blynblack@gmail.com>
Date: Tue, 10 Jun 2025 13:12:50 +1000
Subject: [PATCH 29/34] fix: removed `--feature` flag from wrangler deployment

---
 .github/workflows/application-js-cloudflare-feature.yml | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/.github/workflows/application-js-cloudflare-feature.yml b/.github/workflows/application-js-cloudflare-feature.yml
index 3cf4a3a..4e74bc5 100644
--- a/.github/workflows/application-js-cloudflare-feature.yml
+++ b/.github/workflows/application-js-cloudflare-feature.yml
@@ -122,7 +122,5 @@ jobs:
         run: |
           echo 'Perform service deployment for feature'
           nix develop .#ci --command bash -c $'
-          npm run deploy -- \
-            --feature "$GITHUB_REF_NAME" \
-            --env "$GITHUB_REF_NAME"
+          npm run deploy -- --env "$GITHUB_REF_NAME"
           '

From 1c86e6a9db68949669c24a2325282ede4036f228 Mon Sep 17 00:00:00 2001
From: Brynley Llewellyn-Roux <blynblack@gmail.com>
Date: Tue, 10 Jun 2025 13:29:32 +1000
Subject: [PATCH 30/34] Revert "fix: removed `--feature` flag from wrangler
 deployment"

This reverts commit 1de04a2be70bdc6827f84888258504d6e5ab28df.
---
 .github/workflows/application-js-cloudflare-feature.yml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/application-js-cloudflare-feature.yml b/.github/workflows/application-js-cloudflare-feature.yml
index 4e74bc5..3cf4a3a 100644
--- a/.github/workflows/application-js-cloudflare-feature.yml
+++ b/.github/workflows/application-js-cloudflare-feature.yml
@@ -122,5 +122,7 @@ jobs:
         run: |
           echo 'Perform service deployment for feature'
           nix develop .#ci --command bash -c $'
-          npm run deploy -- --env "$GITHUB_REF_NAME"
+          npm run deploy -- \
+            --feature "$GITHUB_REF_NAME" \
+            --env "$GITHUB_REF_NAME"
           '

From c374e64125dcf9e8e3bab04c50005de66ff6674f Mon Sep 17 00:00:00 2001
From: Roger Qiu <roger.qiu@polyhack.io>
Date: Mon, 16 Feb 2026 07:37:03 +0000
Subject: [PATCH 31/34] fix(ci): stabilise Windows Node selection in reusable
 workflows

- Pin Windows runner to windows-2022 in shared workflows: library-js-staging.yml, native-library-js-staging.yml, native-library-js-tag.yml, native-library-js-tag-gyp.yml
- Remove workflow-level PATH refresh via refreshenv / Chocolatey profile import (prevents Node/npm mismatch after PATH reconstruction)
- Split Windows into two steps: Bootstrap runs ./scripts/choco-install.ps1 and writes Node home to $GITHUB_PATH; Build/Test runs npm in the next step so the selected Node persists
- Add explicit diagnostics (where.exe node/npm, node -v, npm -v, npm exec --yes node -v) in Bootstrap + Build steps to prove node/npm pairing
- Remove workflow-owned Node provisioning from tag workflows so downstream choco-install.ps1 fully owns Node selection: native-library-js-tag.yml, native-library-js-tag-gyp.yml
- Document the Windows two-step/bootstrap requirement in README.md
---
 .github/workflows/library-js-staging.yml      |  74 +++++-----
 .../workflows/native-library-js-staging.yml   |  82 +++++++-----
 .../workflows/native-library-js-tag-gyp.yml   |  95 +++++++------
 .github/workflows/native-library-js-tag.yml   | 126 ++++++++++--------
 README.md                                     |  13 ++
 5 files changed, 228 insertions(+), 162 deletions(-)

diff --git a/.github/workflows/library-js-staging.yml b/.github/workflows/library-js-staging.yml
index 71675ef..433ec93 100644
--- a/.github/workflows/library-js-staging.yml
+++ b/.github/workflows/library-js-staging.yml
@@ -92,36 +92,10 @@ jobs:
         include:
           - platform: linux
             os: ubuntu-latest
-            env: {}
-            script: |
-              nix develop .#ci --command bash -c $'
-              npm test -- --ci --coverage
-              npm run bench --if-present
-              '
           - platform: windows
-            os: windows-latest
-            env: {}
-            script: |
-              mkdir -Force "$CI_PROJECT_DIR/tmp"
-              Import-Module $env:ChocolateyInstall\helpers\chocolateyProfile.psm1
-              ./scripts/choco-install.ps1
-              refreshenv
-              npm install --ignore-scripts
-              $env:Path = "$(npm root)\.bin;" + $env:Path
-              npm test -- --ci --coverage
-              npm run bench --if-present
+            os: windows-2022
           - platform: macos
             os: macos-latest
-            env: {}
-            script: |
-              mkdir -p "$CI_PROJECT_DIR/tmp"
-              eval "$(brew shellenv)"
-              ./scripts/brew-install.sh
-              hash -r
-              npm install --ignore-scripts
-              export PATH="$(npm root)/.bin:$PATH"
-              npm test -- --ci --coverage
-              npm run bench --if-present
     steps:
       - uses: actions/checkout@v4
       - if: matrix.platform == 'linux'
@@ -130,9 +104,49 @@ jobs:
         with:
           name: dist
           path: ./dist
-      - name: Build
-        env: ${{ matrix.env }}
-        run: ${{ matrix.script }}
+      - name: Windows Bootstrap
+        if: matrix.platform == 'windows'
+        shell: pwsh
+        run: |
+          mkdir -Force "$CI_PROJECT_DIR/tmp"
+          ./scripts/choco-install.ps1
+          where.exe node
+          where.exe npm
+          node -v
+          npm -v
+          npm exec --yes node -v
+      - name: Build (Windows)
+        if: matrix.platform == 'windows'
+        shell: pwsh
+        run: |
+          npm install --ignore-scripts
+          $env:Path = "$(npm root)\.bin;" + $env:Path
+          where.exe node
+          where.exe npm
+          node -v
+          npm -v
+          npm exec --yes node -v
+          npm test -- --ci --coverage
+          npm run bench --if-present
+      - name: Build (Linux)
+        if: matrix.platform == 'linux'
+        run: |
+          nix develop .#ci --command bash -c $'
+          npm test -- --ci --coverage
+          npm run bench --if-present
+          '
+      - name: Build (macOS)
+        if: matrix.platform == 'macos'
+        shell: bash
+        run: |
+          mkdir -p "$CI_PROJECT_DIR/tmp"
+          eval "$(brew shellenv)"
+          ./scripts/brew-install.sh
+          hash -r
+          npm install --ignore-scripts
+          export PATH="$(npm root)/.bin:$PATH"
+          npm test -- --ci --coverage
+          npm run bench --if-present
       - name: Upload JUnit Report
         if: success() || failure()
         uses: actions/upload-artifact@v4
diff --git a/.github/workflows/native-library-js-staging.yml b/.github/workflows/native-library-js-staging.yml
index 1637b0c..8da67a8 100644
--- a/.github/workflows/native-library-js-staging.yml
+++ b/.github/workflows/native-library-js-staging.yml
@@ -98,40 +98,10 @@ jobs:
         include:
           - platform: linux
             os: ubuntu-latest
-            env: {}
-            script: |
-              nix develop .#ci --command bash -c $'
-              npm run prebuild --verbose
-              npm test -- --ci --coverage
-              npm run bench --if-present
-              '
           - platform: windows
-            os: windows-latest
-            env: {}
-            script: |
-              mkdir -Force "$CI_PROJECT_DIR/tmp"
-              Import-Module $env:ChocolateyInstall\helpers\chocolateyProfile.psm1
-              ./scripts/choco-install.ps1
-              refreshenv
-              npm install --ignore-scripts
-              $env:Path = "$(npm root)\.bin;" + $env:Path
-              npm run prebuild --verbose
-              npm test -- --ci --coverage
-              npm run bench --if-present
+            os: windows-2022
           - platform: macos
             os: macos-latest
-            env: {}
-            script: |
-              mkdir -p "$CI_PROJECT_DIR/tmp"
-              eval "$(brew shellenv)"
-              ./scripts/brew-install.sh
-              export PYTHON=$(brew --prefix python@3.10)/bin/python3.10
-              hash -r
-              npm install --ignore-scripts
-              export PATH="$(npm root)/.bin:$PATH"
-              npm run prebuild --verbose
-              npm test -- --ci --coverage
-              npm run bench --if-present
     steps:
       - uses: actions/checkout@v4
         with:
@@ -142,9 +112,53 @@ jobs:
         with:
           name: dist
           path: ./dist
-      - name: Build
-        env: ${{ matrix.env }}
-        run: ${{ matrix.script }}
+      - name: Windows Bootstrap
+        if: matrix.platform == 'windows'
+        shell: pwsh
+        run: |
+          mkdir -Force "$CI_PROJECT_DIR/tmp"
+          ./scripts/choco-install.ps1
+          where.exe node
+          where.exe npm
+          node -v
+          npm -v
+          npm exec --yes node -v
+      - name: Build (Windows)
+        if: matrix.platform == 'windows'
+        shell: pwsh
+        run: |
+          npm install --ignore-scripts
+          $env:Path = "$(npm root)\.bin;" + $env:Path
+          where.exe node
+          where.exe npm
+          node -v
+          npm -v
+          npm exec --yes node -v
+          npm run prebuild --verbose
+          npm test -- --ci --coverage
+          npm run bench --if-present
+      - name: Build (Linux)
+        if: matrix.platform == 'linux'
+        run: |
+          nix develop .#ci --command bash -c $'
+          npm run prebuild --verbose
+          npm test -- --ci --coverage
+          npm run bench --if-present
+          '
+      - name: Build (macOS)
+        if: matrix.platform == 'macos'
+        shell: bash
+        run: |
+          mkdir -p "$CI_PROJECT_DIR/tmp"
+          eval "$(brew shellenv)"
+          ./scripts/brew-install.sh
+          export PYTHON=$(brew --prefix python@3.10)/bin/python3.10
+          hash -r
+          npm install --ignore-scripts
+          export PATH="$(npm root)/.bin:$PATH"
+          npm run prebuild --verbose
+          npm test -- --ci --coverage
+          npm run bench --if-present
       - name: Upload JUnit Report
         if: success() || failure()
         uses: actions/upload-artifact@v4
diff --git a/.github/workflows/native-library-js-tag-gyp.yml b/.github/workflows/native-library-js-tag-gyp.yml
index fe95d44..448f60b 100644
--- a/.github/workflows/native-library-js-tag-gyp.yml
+++ b/.github/workflows/native-library-js-tag-gyp.yml
@@ -64,60 +64,73 @@ jobs:
         include:
           - platform: linux
             os: ubuntu-latest
-            env:
-              npm_config_arch: "x64"
-              RUST_BACKTRACE: "1"
-            script: |
-              nix develop .#ci --command bash -c $'
-              npm run prebuild --verbose -- --production
-              npm test -- --ci --coverage
-              npm run bench
-              '
           - platform: windows
-            os: windows-latest
-            env:
-              npm_config_arch: "x64"
-              RUST_BACKTRACE: "1"
-              LIBCLANG_PATH: "C:\\Program Files\\LLVM\\bin"
-            script: |
-              mkdir -Force "$CI_PROJECT_DIR/tmp"
-              Import-Module $env:ChocolateyInstall\helpers\chocolateyProfile.psm1
-              ./scripts/choco-install.ps1
-              refreshenv
-              npm install --ignore-scripts
-              $env:Path = "$(npm root)\.bin;" + $env:Path
-              npm run prebuild --verbose -- --production
-              npm test -- --ci --coverage
-              npm run bench
+            os: windows-2022
           - platform: macos
             os: macos-latest
-            env: {}
-            script: |
-              eval "$(brew shellenv)"
-              ./scripts/brew-install.sh
-              export PYTHON=$(brew --prefix python@3.10)/bin/python3.10
-              hash -r
-              npm install --ignore-scripts
-              export PATH="$(npm root)/.bin:$PATH"
-              npm run prebuild --verbose -- --production
-              npm test -- --ci --coverage
-              npm run bench
     steps:
       - uses: actions/checkout@v4
         with:
           submodules: 'recursive'
       - if: matrix.platform == 'linux'
         uses: MatrixAI/.github/.github/actions/matrixai-env-setup@master
-      - uses: actions/setup-node@v4
-        with:
-          node-version: '20'
       - uses: actions/download-artifact@v4
         with:
           name: dist
           path: ./dist
-      - name: Build
-        env: ${{ matrix.env }}
-        run: ${{ matrix.script }}
+      - name: Windows Bootstrap
+        if: matrix.platform == 'windows'
+        shell: pwsh
+        run: |
+          mkdir -Force "$CI_PROJECT_DIR/tmp"
+          ./scripts/choco-install.ps1
+          where.exe node
+          where.exe npm
+          node -v
+          npm -v
+          npm exec --yes node -v
+      - name: Build (Windows)
+        if: matrix.platform == 'windows'
+        shell: pwsh
+        env:
+          npm_config_arch: "x64"
+          RUST_BACKTRACE: "1"
+          LIBCLANG_PATH: "C:\\Program Files\\LLVM\\bin"
+        run: |
+          npm install --ignore-scripts
+          $env:Path = "$(npm root)\.bin;" + $env:Path
+          where.exe node
+          where.exe npm
+          node -v
+          npm -v
+          npm exec --yes node -v
+          npm run prebuild --verbose -- --production
+          npm test -- --ci --coverage
+          npm run bench
+      - name: Build (Linux)
+        if: matrix.platform == 'linux'
+        env:
+          npm_config_arch: "x64"
+          RUST_BACKTRACE: "1"
+        run: |
+          nix develop .#ci --command bash -c $'
+          npm run prebuild --verbose -- --production
+          npm test -- --ci --coverage
+          npm run bench
+          '
+      - name: Build (macOS)
+        if: matrix.platform == 'macos'
+        shell: bash
+        run: |
+          eval "$(brew shellenv)"
+          ./scripts/brew-install.sh
+          export PYTHON=$(brew --prefix python@3.10)/bin/python3.10
+          hash -r
+          npm install --ignore-scripts
+          export PATH="$(npm root)/.bin:$PATH"
+          npm run prebuild --verbose -- --production
+          npm test -- --ci --coverage
+          npm run bench
       - uses: actions/upload-artifact@v4
         with:
           name: prebuild-${{ matrix.platform }}
diff --git a/.github/workflows/native-library-js-tag.yml b/.github/workflows/native-library-js-tag.yml
index 6b239e9..c85fbb8 100644
--- a/.github/workflows/native-library-js-tag.yml
+++ b/.github/workflows/native-library-js-tag.yml
@@ -64,76 +64,88 @@ jobs:
         include:
           - platform: linux
             os: ubuntu-latest
-            env:
-              npm_config_arch: "x64"
-              RUST_BACKTRACE: "1"
-            script: |
-              nix develop .#ci --command bash -c $'
-              npm run prebuild --verbose -- --production
-              npm test -- --ci --coverage
-              npm run bench
-              '
           - platform: windows
-            os: windows-latest
-            env:
-              npm_config_arch: "x64"
-              RUST_BACKTRACE: "1"
-              LIBCLANG_PATH: "C:\\Program Files\\LLVM\\bin"
-            script: |
-              mkdir -Force "$CI_PROJECT_DIR/tmp"
-              Import-Module $env:ChocolateyInstall\helpers\chocolateyProfile.psm1
-              ./scripts/choco-install.ps1
-              refreshenv
-              npm install --ignore-scripts
-              $env:Path = "$(npm root)\.bin;" + $env:Path
-              npm run prebuild --verbose -- --production
-              npm test -- --ci --coverage
-              npm run bench
+            os: windows-2022
           - platform: macos
             os: macos-latest
-            env:
-              RUST_BACKTRACE: "1"
-            script: |
-              eval "$(brew shellenv)"
-              ./scripts/brew-install.sh
-              export PYTHON=$(brew --prefix python@3.10)/bin/python3.10
-              hash -r
-              npm install --ignore-scripts
-              export PATH="$(npm root)/.bin:$PATH"
-              export PATH="$HOME/.cargo/bin:$PATH"
-              echo "Prebuilding for darwin-x64"
-              npm run prebuild --verbose -- --arch x64 --production
-              echo "Prebuilding for darwin-arm64"
-              npm run prebuild --verbose -- --arch arm64 --production
-              echo "Creating universal binary"
-              for f in prebuild/*-darwin-arm64.node; do
-                prefix=$(basename "$f" | sed -E 's/-darwin-arm64\.node$//')
-                lipo -create \
-                  -output "prebuild/${prefix}-darwin-x64+arm64.node" \
-                  "prebuild/${prefix}-darwin-arm64.node" \
-                  "prebuild/${prefix}-darwin-x64.node"
-              done
-              rm -rf node_modules/@matrixai/*-*
-              echo "Running tests"
-              npm test -- --ci --coverage
-              echo "Running benchmarks"
-              npm run bench
     steps:
       - uses: actions/checkout@v4
         with:
           submodules: 'recursive'
       - if: matrix.platform == 'linux'
         uses: MatrixAI/.github/.github/actions/matrixai-env-setup@master
-      - uses: actions/setup-node@v4
-        with:
-          node-version: '20'
       - uses: actions/download-artifact@v4
         with:
           name: dist
           path: ./dist
-      - name: Build
-        env: ${{ matrix.env }}
-        run: ${{ matrix.script }}
+      - name: Windows Bootstrap
+        if: matrix.platform == 'windows'
+        shell: pwsh
+        run: |
+          mkdir -Force "$CI_PROJECT_DIR/tmp"
+          ./scripts/choco-install.ps1
+          where.exe node
+          where.exe npm
+          node -v
+          npm -v
+          npm exec --yes node -v
+      - name: Build (Windows)
+        if: matrix.platform == 'windows'
+        shell: pwsh
+        env:
+          npm_config_arch: "x64"
+          RUST_BACKTRACE: "1"
+          LIBCLANG_PATH: "C:\\Program Files\\LLVM\\bin"
+        run: |
+          npm install --ignore-scripts
+          $env:Path = "$(npm root)\.bin;" + $env:Path
+          where.exe node
+          where.exe npm
+          node -v
+          npm -v
+          npm exec --yes node -v
+          npm run prebuild --verbose -- --production
+          npm test -- --ci --coverage
+          npm run bench
+      - name: Build (Linux)
+        if: matrix.platform == 'linux'
+        env:
+          npm_config_arch: "x64"
+          RUST_BACKTRACE: "1"
+        run: |
+          nix develop .#ci --command bash -c $'
+          npm run prebuild --verbose -- --production
+          npm test -- --ci --coverage
+          npm run bench
+          '
+      - name: Build (macOS)
+        if: matrix.platform == 'macos'
+        shell: bash
+        run: |
+          eval "$(brew shellenv)"
+          ./scripts/brew-install.sh
+          export PYTHON=$(brew --prefix python@3.10)/bin/python3.10
+          hash -r
+          npm install --ignore-scripts
+          export PATH="$(npm root)/.bin:$PATH"
+          export PATH="$HOME/.cargo/bin:$PATH"
+          echo "Prebuilding for darwin-x64"
+          npm run prebuild --verbose -- --arch x64 --production
+          echo "Prebuilding for darwin-arm64"
+          npm run prebuild --verbose -- --arch arm64 --production
+          echo "Creating universal binary"
+          for f in prebuild/*-darwin-arm64.node; do
+            prefix=$(basename "$f" | sed -E 's/-darwin-arm64\.node$//')
+            lipo -create \
+              -output "prebuild/${prefix}-darwin-x64+arm64.node" \
+              "prebuild/${prefix}-darwin-arm64.node" \
+              "prebuild/${prefix}-darwin-x64.node"
+          done
+          rm -rf node_modules/@matrixai/*-*
+          echo "Running tests"
+          npm test -- --ci --coverage
+          echo "Running benchmarks"
+          npm run bench
       - uses: actions/upload-artifact@v4
         with:
           name: prebuild-${{ matrix.platform }}
diff --git a/README.md b/README.md
index 6d9e12f..bce300d 100644
--- a/README.md
+++ b/README.md
@@ -17,6 +17,19 @@ Ensure that this repository is mirrored from GitLab to GitHub.
 This is where we centralized re-usable workflows for GitHub actions. Workflows
 are grouped together into different kinds of projects.
 
+### Windows runners and Node.js
+
+On GitHub-hosted Windows runners it is common to have multiple Node versions on `PATH` (for example Node 22 may be preinstalled). If a workflow calls `refreshenv` / `Update-SessionEnvironment` after selecting Node, it can rebuild `PATH` and cause `npm.cmd` to come from a different Node installation than `node.exe`.
+
+To avoid the Node/npm mismatch:
+
+* Windows jobs are pinned to `windows-2022`.
+* Windows execution is split into two steps:
+  1. **Bootstrap** runs repo-local `./scripts/choco-install.ps1` and prints:
+     `where.exe node`, `where.exe npm`, `node -v`, `npm -v`, `npm exec --yes node -v`.
+  2. **Build/Test** runs npm commands in a separate step so `$GITHUB_PATH` updates from the bootstrap step are applied deterministically.
+* Reusable workflows in this repository do not use `actions/setup-node` for Windows; they delegate Node selection to the downstream repo’s `./scripts/choco-install.ps1`.
+
 * library-js - TS/JS projects that produce libraries as NPM packages.
   - feature - for feature branches
   - staging - for staging branches

From ce9b66ec607240ecc8a2ce2f66ed89692c122171 Mon Sep 17 00:00:00 2001
From: Roger Qiu <roger.qiu@polyhack.io>
Date: Mon, 16 Feb 2026 07:51:56 +0000
Subject: [PATCH 32/34] =?UTF-8?q?fix:=20fixed=20npm=20exec=20verification?=
 =?UTF-8?q?=20to=20include=20the=20terminator=20--=20so=20npm=20v10=20does?=
 =?UTF-8?q?n=E2=80=99t=20treat=20the=20command=20as=20an=20option:=20updat?=
 =?UTF-8?q?ed=20in=20js-lint=20script=20and=20all=20shared=20workflows.?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .github/workflows/library-js-staging.yml        | 4 ++--
 .github/workflows/native-library-js-staging.yml | 4 ++--
 .github/workflows/native-library-js-tag-gyp.yml | 4 ++--
 .github/workflows/native-library-js-tag.yml     | 4 ++--
 4 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/library-js-staging.yml b/.github/workflows/library-js-staging.yml
index 433ec93..a39ba68 100644
--- a/.github/workflows/library-js-staging.yml
+++ b/.github/workflows/library-js-staging.yml
@@ -114,7 +114,7 @@ jobs:
           where.exe npm
           node -v
           npm -v
-          npm exec --yes node -v
+          npm exec --yes -- node -v
       - name: Build (Windows)
         if: matrix.platform == 'windows'
         shell: pwsh
@@ -125,7 +125,7 @@ jobs:
           where.exe npm
           node -v
           npm -v
-          npm exec --yes node -v
+          npm exec --yes -- node -v
           npm test -- --ci --coverage
           npm run bench --if-present
       - name: Build (Linux)
diff --git a/.github/workflows/native-library-js-staging.yml b/.github/workflows/native-library-js-staging.yml
index 8da67a8..565f416 100644
--- a/.github/workflows/native-library-js-staging.yml
+++ b/.github/workflows/native-library-js-staging.yml
@@ -122,7 +122,7 @@ jobs:
           where.exe npm
           node -v
           npm -v
-          npm exec --yes node -v
+          npm exec --yes -- node -v
       - name: Build (Windows)
         if: matrix.platform == 'windows'
         shell: pwsh
@@ -133,7 +133,7 @@ jobs:
           where.exe npm
           node -v
           npm -v
-          npm exec --yes node -v
+          npm exec --yes -- node -v
           npm run prebuild --verbose
           npm test -- --ci --coverage
           npm run bench --if-present
diff --git a/.github/workflows/native-library-js-tag-gyp.yml b/.github/workflows/native-library-js-tag-gyp.yml
index 448f60b..0c750a7 100644
--- a/.github/workflows/native-library-js-tag-gyp.yml
+++ b/.github/workflows/native-library-js-tag-gyp.yml
@@ -88,7 +88,7 @@ jobs:
           where.exe npm
           node -v
           npm -v
-          npm exec --yes node -v
+          npm exec --yes -- node -v
       - name: Build (Windows)
         if: matrix.platform == 'windows'
         shell: pwsh
@@ -103,7 +103,7 @@ jobs:
           where.exe npm
           node -v
           npm -v
-          npm exec --yes node -v
+          npm exec --yes -- node -v
           npm run prebuild --verbose -- --production
           npm test -- --ci --coverage
           npm run bench
diff --git a/.github/workflows/native-library-js-tag.yml b/.github/workflows/native-library-js-tag.yml
index c85fbb8..fc1ce51 100644
--- a/.github/workflows/native-library-js-tag.yml
+++ b/.github/workflows/native-library-js-tag.yml
@@ -88,7 +88,7 @@ jobs:
           where.exe npm
           node -v
           npm -v
-          npm exec --yes node -v
+          npm exec --yes -- node -v
       - name: Build (Windows)
         if: matrix.platform == 'windows'
         shell: pwsh
@@ -103,7 +103,7 @@ jobs:
           where.exe npm
           node -v
           npm -v
-          npm exec --yes node -v
+          npm exec --yes -- node -v
           npm run prebuild --verbose -- --production
           npm test -- --ci --coverage
           npm run bench

From 74335e07dad1bf0b715b1bbd78c9e1e0dbdbdf88 Mon Sep 17 00:00:00 2001
From: Roger Qiu <roger.qiu@polyhack.io>
Date: Mon, 16 Feb 2026 08:24:37 +0000
Subject: [PATCH 33/34] =?UTF-8?q?fix:=20shared=20workflows=20(.github/work?=
 =?UTF-8?q?flows/library-js-staging.yml,=20native-library-js-staging.yml,?=
 =?UTF-8?q?=20native-library-js-tag.yml,=20native-library-js-tag-gyp.yml):?=
 =?UTF-8?q?=20Windows=20diagnostics=20now=20use=20where.exe=20node/npm,=20?=
 =?UTF-8?q?node=20-v,=20npm=20-v,=20and=20npm=20config=20get=20user-agent?=
 =?UTF-8?q?=20(removed=20npm=20exec=20=E2=80=A6=20node=20-v=20to=20prevent?=
 =?UTF-8?q?=20npm=20auto-installing=20a=20registry=20node=20package).=20Th?=
 =?UTF-8?q?is=20preserves=20the=20two-step=20Windows=20flow=20and=20window?=
 =?UTF-8?q?s-2022=20runner.?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .github/workflows/library-js-staging.yml        | 4 ++--
 .github/workflows/native-library-js-staging.yml | 4 ++--
 .github/workflows/native-library-js-tag-gyp.yml | 4 ++--
 .github/workflows/native-library-js-tag.yml     | 4 ++--
 4 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/library-js-staging.yml b/.github/workflows/library-js-staging.yml
index a39ba68..504a0c5 100644
--- a/.github/workflows/library-js-staging.yml
+++ b/.github/workflows/library-js-staging.yml
@@ -114,7 +114,7 @@ jobs:
           where.exe npm
           node -v
           npm -v
-          npm exec --yes -- node -v
+          npm config get user-agent
       - name: Build (Windows)
         if: matrix.platform == 'windows'
         shell: pwsh
@@ -125,7 +125,7 @@ jobs:
           where.exe npm
           node -v
           npm -v
-          npm exec --yes -- node -v
+          npm config get user-agent
           npm test -- --ci --coverage
           npm run bench --if-present
       - name: Build (Linux)
diff --git a/.github/workflows/native-library-js-staging.yml b/.github/workflows/native-library-js-staging.yml
index 565f416..ef93471 100644
--- a/.github/workflows/native-library-js-staging.yml
+++ b/.github/workflows/native-library-js-staging.yml
@@ -122,7 +122,7 @@ jobs:
           where.exe npm
           node -v
           npm -v
-          npm exec --yes -- node -v
+          npm config get user-agent
       - name: Build (Windows)
         if: matrix.platform == 'windows'
         shell: pwsh
@@ -133,7 +133,7 @@ jobs:
           where.exe npm
           node -v
           npm -v
-          npm exec --yes -- node -v
+          npm config get user-agent
           npm run prebuild --verbose
           npm test -- --ci --coverage
           npm run bench --if-present
diff --git a/.github/workflows/native-library-js-tag-gyp.yml b/.github/workflows/native-library-js-tag-gyp.yml
index 0c750a7..0f0a835 100644
--- a/.github/workflows/native-library-js-tag-gyp.yml
+++ b/.github/workflows/native-library-js-tag-gyp.yml
@@ -88,7 +88,7 @@ jobs:
           where.exe npm
           node -v
           npm -v
-          npm exec --yes -- node -v
+          npm config get user-agent
       - name: Build (Windows)
         if: matrix.platform == 'windows'
         shell: pwsh
@@ -103,7 +103,7 @@ jobs:
           where.exe npm
           node -v
           npm -v
-          npm exec --yes -- node -v
+          npm config get user-agent
           npm run prebuild --verbose -- --production
           npm test -- --ci --coverage
           npm run bench
diff --git a/.github/workflows/native-library-js-tag.yml b/.github/workflows/native-library-js-tag.yml
index fc1ce51..8902ac9 100644
--- a/.github/workflows/native-library-js-tag.yml
+++ b/.github/workflows/native-library-js-tag.yml
@@ -88,7 +88,7 @@ jobs:
           where.exe npm
           node -v
           npm -v
-          npm exec --yes -- node -v
+          npm config get user-agent
       - name: Build (Windows)
         if: matrix.platform == 'windows'
         shell: pwsh
@@ -103,7 +103,7 @@ jobs:
           where.exe npm
           node -v
           npm -v
-          npm exec --yes -- node -v
+          npm config get user-agent
           npm run prebuild --verbose -- --production
           npm test -- --ci --coverage
           npm run bench

From dda1c88cbfb22cfac448b5b7511275c46a8a3724 Mon Sep 17 00:00:00 2001
From: Roger Qiu <roger.qiu@polyhack.io>
Date: Mon, 16 Feb 2026 08:51:18 +0000
Subject: [PATCH 34/34] fix: removed `npm config get user-agent` because it
 only tells us `npm/{npm-version} node/{node-version} {platform} {arch}
 workspaces/{workspaces} {ci}` which is useless

---
 .github/workflows/library-js-staging.yml        | 2 --
 .github/workflows/native-library-js-staging.yml | 2 --
 .github/workflows/native-library-js-tag-gyp.yml | 2 --
 .github/workflows/native-library-js-tag.yml     | 2 --
 4 files changed, 8 deletions(-)

diff --git a/.github/workflows/library-js-staging.yml b/.github/workflows/library-js-staging.yml
index 504a0c5..4e92368 100644
--- a/.github/workflows/library-js-staging.yml
+++ b/.github/workflows/library-js-staging.yml
@@ -114,7 +114,6 @@ jobs:
           where.exe npm
           node -v
           npm -v
-          npm config get user-agent
       - name: Build (Windows)
         if: matrix.platform == 'windows'
         shell: pwsh
@@ -125,7 +124,6 @@ jobs:
           where.exe npm
           node -v
           npm -v
-          npm config get user-agent
           npm test -- --ci --coverage
           npm run bench --if-present
       - name: Build (Linux)
diff --git a/.github/workflows/native-library-js-staging.yml b/.github/workflows/native-library-js-staging.yml
index ef93471..2ff19d1 100644
--- a/.github/workflows/native-library-js-staging.yml
+++ b/.github/workflows/native-library-js-staging.yml
@@ -122,7 +122,6 @@ jobs:
           where.exe npm
           node -v
           npm -v
-          npm config get user-agent
       - name: Build (Windows)
         if: matrix.platform == 'windows'
         shell: pwsh
@@ -133,7 +132,6 @@ jobs:
           where.exe npm
           node -v
           npm -v
-          npm config get user-agent
           npm run prebuild --verbose
           npm test -- --ci --coverage
           npm run bench --if-present
diff --git a/.github/workflows/native-library-js-tag-gyp.yml b/.github/workflows/native-library-js-tag-gyp.yml
index 0f0a835..5025739 100644
--- a/.github/workflows/native-library-js-tag-gyp.yml
+++ b/.github/workflows/native-library-js-tag-gyp.yml
@@ -88,7 +88,6 @@ jobs:
           where.exe npm
           node -v
           npm -v
-          npm config get user-agent
       - name: Build (Windows)
         if: matrix.platform == 'windows'
         shell: pwsh
@@ -103,7 +102,6 @@ jobs:
           where.exe npm
           node -v
           npm -v
-          npm config get user-agent
           npm run prebuild --verbose -- --production
           npm test -- --ci --coverage
           npm run bench
diff --git a/.github/workflows/native-library-js-tag.yml b/.github/workflows/native-library-js-tag.yml
index 8902ac9..141da76 100644
--- a/.github/workflows/native-library-js-tag.yml
+++ b/.github/workflows/native-library-js-tag.yml
@@ -88,7 +88,6 @@ jobs:
           where.exe npm
           node -v
           npm -v
-          npm config get user-agent
       - name: Build (Windows)
         if: matrix.platform == 'windows'
         shell: pwsh
@@ -103,7 +102,6 @@ jobs:
           where.exe npm
           node -v
           npm -v
-          npm config get user-agent
           npm run prebuild --verbose -- --production
           npm test -- --ci --coverage
           npm run bench