Cursor AgentandRotimi Best
9adc38bd8a
Isolate npm publish from PR CI, enforce frozen lockfiles and a 24h minimumReleaseAge, and document safe pull_request_target usage so fork PRs cannot reach publish credentials. Co-authored-by: Rotimi Best <[email protected]>
15 lines
396 B
YAML
15 lines
396 B
YAML
packages:
|
|
- apps/*
|
|
- '!apps/db-agent'
|
|
- packages/*
|
|
- packages/course-app/src/*
|
|
onlyBuiltDependencies:
|
|
- esbuild
|
|
- '@tailwindcss/oxide'
|
|
# Block brand-new registry publishes for 24h (supply-chain cooldown).
|
|
# Locked versions in pnpm-lock.yaml stay installable; this gates adds/updates.
|
|
minimumReleaseAge: 1440
|
|
minimumReleaseAgeExclude:
|
|
- '@getworkbench/hono'
|
|
- '@getworkbench/core'
|