[II-X] Harden Toolchain

[ooaklee]

Context

Interactive Inputs ships as a GitHub Action with a JavaScript entrypoint, checked-in Go binaries, generated README input documentation, and a small Go web portal. The repository needed a current, reproducible toolchain baseline so maintainers can rebuild the action with known language versions and safer dependency provenance.

The previous dependency graph also included the old action-docs package chain, which brought in vulnerable transitive packages for a task that this repository can perform locally from action.yml. At the same time, the action wrapper and field-definition comments needed clearer behaviour and maintenance guidance for future template users.

What Changed

• Pinned the repository toolchain to Node.js 24.16.0, Yarn 1.22.22, and Go 1.26.4 via .tool-versions.
• Updated the GitHub Action runtime metadata to node24.
• Replaced action-docs with a local README input-table generator and refreshed yarn.lock.
• Upgraded Go dependencies to current safe compatible versions, refreshed go.mod and go.sum, and documented the accepted go.yaml.in/yaml/v3 provenance.
• Rebuilt the checked-in Linux AMD64 and ARM64 action binaries with the pinned Go toolchain.
• Hardened invoke-binary.js so unsupported platforms, unsupported architectures, spawn failures, signals, and missing process statuses fail explicitly.
• Corrected notifier action metadata for optional Slack and Discord inputs and fixed the default notifications channel spelling.
• Added positive timeout validation and focused regression coverage.
• Added clearer documentation comments for action entrypoints, runner flow, portal handlers, notifier methods, and the full interactive field YAML shape.
• Moved Husky to the v9 tracked pre-commit hook layout.
• Added an ADR template and a toolchain-modernisation ADR.
• Updated README and getting-started guidance for adapting, rebuilding, and publishing the action with the pinned toolchain.

Why

This keeps the action template easier to maintain and safer to consume. Pinning the toolchain reduces ambiguity when rebuilding binaries or regenerating docs, while removing the vulnerable documentation dependency chain avoids carrying unnecessary package risk.

The wrapper hardening makes runner failures visible instead of silently succeeding, and the action metadata fixes make generated docs and GitHub Action inputs match the intended optional notifier behaviour.

The expanded comments and ADRs should also make the repository more useful as a template for future Go-backed JavaScript actions.

Scope Notes

This PR focuses on the action template, toolchain, dependency baseline, generated documentation, and validation behaviour. It does not redesign the interactive input portal or change the submitted form payload shape.

The user-visible behaviour change is that invalid non-positive timeout values now fail validation instead of being accepted. The Slack notifications channel default is also corrected from the misspelled value to #notifications.

The checked-in dist/action-amd64 and dist/action-arm64 binaries are intentionally updated so consumers can run the action without rebuilding it during workflow execution.

How To Test

Requires the pinned asdf toolchain from .tool-versions.

• asdf install
• asdf exec yarn install --frozen-lockfile --check-files
• asdf exec yarn check --integrity
• asdf exec yarn audit
• npm audit signatures
• lockfile integrity scan confirming all registry packages have integrity hashes
• asdf exec yarn test
• asdf exec yarn package
• asdf exec yarn readme --update
• asdf exec yarn prettier --check action.yml package.json invoke-binary.js scripts/update-readme.js docs/adr/_adr000-template.md docs/adr/adr001-modernise-interactive-inputs-toolchain.md gettting-started.md .github/workflows/test-interactive-input.yaml .github/workflows/test-interactive-input-pr.yaml
• asdf exec go run golang.org/x/vuln/cmd/govulncheck@latest ./...
• git diff --check
• public docs hygiene scan

Rollout Notes

After merge, maintainers should run asdf install before rebuilding binaries or regenerating README input documentation. The root .tool-versions file is now the source of truth for local toolchain versions.

Consumers should receive the rebuilt Linux action binaries from the repository as before. If a workflow pins older runner assumptions, verify that it is compatible with the node24 GitHub Action runtime before rolling forward.

Future dependency updates should keep the local README generator unless a replacement documentation tool has a smaller and cleanly audited dependency graph.