From 799de1d2dcb5339eaa1a2c8ad2a15869b50297a3 Mon Sep 17 00:00:00 2001
From: Jordan Harband <ljharb@gmail.com>
Date: Mon, 2 Nov 2026 13:42:07 -0600
Subject: [PATCH] [actions] TOC: use `node/install` instead of `setup-node`

`lts/*` is now node 26, which is not in the runner's tool cache,
so `setup-node` downloads it from a GitHub release asset host that the harden-runner allowlist blocks.
`node/install` installs node with nvm from nodejs.org, like the other workflows.
---
 .github/workflows/toc.yml | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/toc.yml b/.github/workflows/toc.yml
index 1a133ae9..f026c51d 100644
--- a/.github/workflows/toc.yml
+++ b/.github/workflows/toc.yml
@@ -19,6 +19,8 @@ jobs:
       with:
         allowed-endpoints:
           github.com:443
+          raw.githubusercontent.com:443
+          nodejs.org:443
           registry.npmjs.org:443
           api.github.com:443
     - uses: actions/checkout@v6
@@ -29,10 +31,10 @@ jobs:
 
     # pulls all tags (needed for lerna / semantic release to correctly version)
     - run: git fetch --depth=1 origin +refs/tags/*:refs/tags/*
-    - uses: actions/setup-node@v6
+    - uses: ljharb/actions/node/install@main
+      name: 'nvm install lts/* && npm install'
       with:
         node-version: 'lts/*'
-    - run: npm install
     - run: npm run doctoc
     - name: commit changes
       uses: ljharb/actions-js-build/commit@v3+amendpush