[mpsq]

PE-1482

CI reads the Node version from .nvmrc, and Dependabot cannot update that file. This adds a scheduled job that opens a one-file .nvmrc PR when a newer release of the same major is out.

• scheduled-node-version-bump.yml runs at 06:00 and 18:00 UTC. It is a copy of the node-version-bump workflow in team-plain/github-actions, since a public repo cannot call a reusable workflow from a private one. It opens PRs with the GH_WORKFLOW_APP_* app so CI runs on them

---

Note

Low Risk
CI-only automation that opens PRs for .nvmrc updates; no runtime or application code changes, though it uses a GitHub App with contents/PR write for automation.

Overview
Adds a scheduled GitHub Actions workflow (scheduled-node-version-bump.yml) that keeps .nvmrc current when a newer same-major Node.js release exists—filling the gap left because Dependabot cannot update that file while CI already reads the version from it.

The job runs twice daily (06:00 and 18:00 UTC) and on manual dispatch. It checks out the default branch, compares the pinned semver in .nvmrc against nodejs.org’s index (skipping if .nvmrc is major-only or already up to date), then commits the bump on a fixed node-version-bump branch and opens or updates a single PR titled with PE-1482. Authentication uses the GitHub App (GH_WORKFLOW_APP_*) so PRs get normal CI runs; workflow permissions stay read-only at the workflow level with write scoped via the app token.

^{Reviewed by Cursor Bugbot for commit 4a32514. Bugbot is set up for automated code reviews on this repo. Configure here.}