build: Install Kafka binding on fresh clone (#36502)

.github/scripts/docker/kafka-native-smoke-check.mjs

@@ -14,7 +14,9 @@ const REQUIRED_FEATURES = ['ssl', 'sasl_scram'];
 const COMPRESSION_CODECS = ['gzip', 'snappy', 'lz4', 'zstd'];
 
 const n8nInstallDir = process.env.N8N_INSTALL_DIR || '/usr/local/lib/node_modules/n8n';
-const nodesBasePackageJson = path.join(n8nInstallDir, 'node_modules/n8n-nodes-base/package.json');
+const nodesBasePackageJson =
+	process.env.NODES_BASE_PACKAGE_JSON ||
+	path.join(n8nInstallDir, 'node_modules/n8n-nodes-base/package.json');
 // n8n-nodes-base is a pnpm symlink; resolve it so require() walks up from its real
 // location in the pnpm virtual store, where its dependencies actually live.
 const require = createRequire(realpathSync(nodesBasePackageJson));

.github/workflows/test-unit-reusable.yml

@@ -54,6 +54,13 @@ jobs:
         with:
           node-version: ${{ inputs.nodeVersion }}
 
+      # Confluent publishes prebuilds up to Node 24 only.
+      - name: Verify Kafka native binding installed
+        if: startsWith(inputs.nodeVersion, '24.')
+        env:
+          NODES_BASE_PACKAGE_JSON: packages/nodes-base/package.json
+        run: node .github/scripts/docker/kafka-native-smoke-check.mjs
+
       # cli is the only backend package wired into janitor scoping today, so
       # the workspace bulk run excludes it and a dedicated step invokes the
       # scoped variant. This avoids turbo silently no-op'ing `test:unit:changed`