chore(ci): harden supply-chain controls before reopening PRs

Isolate npm publish from PR CI, enforce frozen lockfiles and a 24h minimumReleaseAge, and document safe pull_request_target usage so fork PRs cannot reach publish credentials. Co-authored-by: Rotimi Best <[email protected]>
2026-08-10 21:00:29 +01:00
parent bbf5eb24de
commit 9adc38bd8a
13 changed files with 100 additions and 24 deletions
@@ -5,6 +5,11 @@ on:
    types:
      - created
      - edited
+
+permissions:
+  contents: read
+  issues: write
+
 jobs:
  take-issue:
    name: Disable take issue