ulivargas/classroomio
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

chore(ci): harden supply-chain controls before reopening PRs

Browse Source 
Isolate npm publish from PR CI, enforce frozen lockfiles and a 24h
minimumReleaseAge, and document safe pull_request_target usage so fork
PRs cannot reach publish credentials.

Co-authored-by: Rotimi Best <rotimi-best@users.noreply.github.com>
This commit is contained in:
Cursor Agent
2026-08-10 21:00:29 +01:00
committed by Rotimi Best
co-authored by Rotimi Best
parent bbf5eb24de
commit 9adc38bd8a
13 changed files with 100 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/CODEOWNERS
+5
View File
@@ -0,0 +1,5 @@
# High-risk supply-chain paths — prefer maintainer review before merge.
/.github/workflows/ @rotimi-best
/pnpm-lock.yaml @rotimi-best
/pnpm-workspace.yaml @rotimi-best
/package.json @rotimi-best