chore(ci): harden supply-chain controls before reopening PRs

Isolate npm publish from PR CI, enforce frozen lockfiles and a 24h minimumReleaseAge, and document safe pull_request_target usage so fork PRs cannot reach publish credentials. Co-authored-by: Rotimi Best <[email protected]>
2026-08-10 21:00:29 +01:00
parent bbf5eb24de
commit 9adc38bd8a
13 changed files with 100 additions and 24 deletions
@@ -12,6 +12,9 @@ on:
      - 'packages/ui/**'
      - '.github/workflows/ui-prefix-check.yml'

+permissions:
+  contents: read
+
 jobs:
  ui-prefix:
    runs-on: ubuntu-latest