ulivargas/classroomio
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

chore(ci): harden supply-chain controls before reopening PRs

Browse Source 
Isolate npm publish from PR CI, enforce frozen lockfiles and a 24h
minimumReleaseAge, and document safe pull_request_target usage so fork
PRs cannot reach publish credentials.

Co-authored-by: Rotimi Best <[email protected]>
This commit is contained in:
Cursor Agent
2026-08-10 21:00:29 +01:00
committed by Rotimi Best
co-authored by Rotimi Best
parent bbf5eb24de
commit 9adc38bd8a
13 changed files with 100 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files
CONTRIBUTING.md
+4
View File
@@ -22,6 +22,10 @@ Ready to dive into the code and make a real impact? Here's your path:
Would you prefer a chat before you dive into a lot of work? Our [Discord server](https://dub.sh/ciodiscord) is your harbor. Share your thoughts, and we'll meet you there with open arms. We're responsive and friendly, promise!
## Dependency and workflow changes
PRs that touch `pnpm-lock.yaml`, `.github/workflows/**`, or npm publish config get extra review. Prefer the smallest lockfile diff that matches your change, and do not add `pull_request_target` workflows that check out or build untrusted PR code.
## Features
If you spot a feature that isn't part of our official plan but could propel ClassroomIO forward, don't hesitate. Raise it as an enhancement issue, and let us know you're ready to take the lead. We'll be quick to respond.