chore(ci): harden supply-chain controls before reopening PRs

Isolate npm publish from PR CI, enforce frozen lockfiles and a 24h minimumReleaseAge, and document safe pull_request_target usage so fork PRs cannot reach publish credentials. Co-authored-by: Rotimi Best <rotimi-best@users.noreply.github.com>
2026-08-10 21:00:29 +01:00
parent bbf5eb24de
commit 9adc38bd8a
13 changed files with 100 additions and 24 deletions
@@ -24,6 +24,9 @@ on:
      - '.nvmrc'
      - '.github/workflows/package-build-check.yml'

+permissions:
+  contents: read
+
 jobs:
  build:
    runs-on: ubuntu-latest