Cursor AgentandRotimi Best
9adc38bd8a
Isolate npm publish from PR CI, enforce frozen lockfiles and a 24h minimumReleaseAge, and document safe pull_request_target usage so fork PRs cannot reach publish credentials. Co-authored-by: Rotimi Best <[email protected]>
6 lines
197 B
Plaintext
6 lines
197 B
Plaintext
# High-risk supply-chain paths — prefer maintainer review before merge.
|
|
/.github/workflows/ @rotimi-best
|
|
/pnpm-lock.yaml @rotimi-best
|
|
/pnpm-workspace.yaml @rotimi-best
|
|
/package.json @rotimi-best
|