chore(ci): harden supply-chain controls before reopening PRs

Isolate npm publish from PR CI, enforce frozen lockfiles and a 24h minimumReleaseAge, and document safe pull_request_target usage so fork PRs cannot reach publish credentials. Co-authored-by: Rotimi Best <[email protected]>
2026-08-10 21:00:29 +01:00
parent bbf5eb24de
commit 9adc38bd8a
13 changed files with 100 additions and 24 deletions
@@ -6,6 +6,9 @@ packages:
 onlyBuiltDependencies:
  - esbuild
  - '@tailwindcss/oxide'
+# Block brand-new registry publishes for 24h (supply-chain cooldown).
+# Locked versions in pnpm-lock.yaml stay installable; this gates adds/updates.
+minimumReleaseAge: 1440
 minimumReleaseAgeExclude:
  - '@getworkbench/hono'
  - '@getworkbench/core'