ci: harden workflows and switch automation to pnpm

Pin GitHub Actions to commit SHAs, set default empty permissions,
add job timeouts, and disable checkout credential persistence to
tighten workflow security.

Update CI, release, and repo scripts to use pnpm instead of npm so
automation matches the project's package manager and produces more
consistent installs and builds.ci: harden workflows and switch automation to pnpm

Pin GitHub Actions to commit SHAs, set default empty permissions,
add job timeouts, and disable checkout credential persistence to
tighten workflow security.

Update CI, release, and repo scripts to use pnpm instead of npm so
automation matches the project's package manager and produces more
consistent installs and builds.

Author: FS

.github/workflows/ci.yml

@@ -4,24 +4,31 @@ on:
   push:
   pull_request:
 
+permissions: {}
+
 jobs:
   ci:
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     permissions:
       contents: read
-      pull-requests: read
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
+      - uses: pnpm/action-setup@9fd676a19091d4595eefd76e4bd31c97133911f1 # v4.2.0
+        with:
+          version: 8.15.4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: 20
-          cache: npm
-      - run: npm ci
-      - run: npm run lint
-      - run: npm run typecheck
-      - run: npm run coverage
-      - run: npm run build
-      - uses: actions/upload-artifact@v4
+          cache: pnpm
+      - run: pnpm install --frozen-lockfile
+      - run: pnpm run lint
+      - run: pnpm run typecheck
+      - run: pnpm run coverage
+      - run: pnpm run build
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         if: always()
         with:
           name: coverage-report

.github/workflows/release.yml

@@ -5,25 +5,32 @@ on:
     tags:
       - 'v*'
 
+permissions: {}
+
 jobs:
   release:
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     permissions:
       contents: write
-      pull-requests: read
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
+      - uses: pnpm/action-setup@9fd676a19091d4595eefd76e4bd31c97133911f1 # v4.2.0
+        with:
+          version: 8.15.4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: 20
-          cache: npm
-      - run: npm ci
-      - run: npm run lint
-      - run: npm run typecheck
-      - run: npm run coverage
-      - run: npm run validate
-      - run: npm run build
+          cache: pnpm
+      - run: pnpm install --frozen-lockfile
+      - run: pnpm run lint
+      - run: pnpm run typecheck
+      - run: pnpm run coverage
+      - run: pnpm run validate
+      - run: pnpm run build
       - run: test -f action.yml
-      - uses: softprops/action-gh-release@v2
+      - uses: softprops/action-gh-release@6da8fa9354ddfdc4aeace5fc48d7f679b5214090 # v2.4.1
         with:
           generate_release_notes: true

.github/workflows/self-test.yml

@@ -3,26 +3,34 @@ name: self-test
 on:
   pull_request:
 
+permissions: {}
+
 jobs:
   pass-case:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     permissions:
       contents: read
       pull-requests: read
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
       - uses: ./
         with:
           github-token: ${{ github.token }}
           config-path: tests/fixtures/self-test/pass.yml
 
   fail-case:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     permissions:
       contents: read
       pull-requests: read
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
       - id: policy-gate
         continue-on-error: true
         uses: ./

AGENTS.md

@@ -182,9 +182,9 @@ unless there is a concrete, high-signal need.
 
 A change is not done unless the repo still supports:
 
-- `npm run check`
-- `npm run validate`
-- `npm run release-dry-run`
+- `pnpm run check`
+- `pnpm run validate`
+- `pnpm run release-dry-run`
 
 Coverage is part of the contract. Do not weaken it casually.
 

dist/index.js

@@ -4199,15 +4199,15 @@ var require_util2 = __commonJS({
           return referrerOrigin;
         }
         case "strict-origin":
-         
+        // eslint-disable-line
         /**
            * 1. If referrerURL is a potentially trustworthy URL and
            * request’s current URL is not a potentially trustworthy URL,
            * then return no referrer.
            * 2. Return referrerOrigin
           */
         case "no-referrer-when-downgrade":
-         
+        // eslint-disable-line
         /**
          * 1. If referrerURL is a potentially trustworthy URL and
          * request’s current URL is not a potentially trustworthy URL,
@@ -5692,7 +5692,7 @@ var require_client_h1 = __commonJS({
       }
       return await WebAssembly.instantiate(mod, {
         env: {
-           
+          /* eslint-disable camelcase */
           wasm_on_url: (p, at, len) => {
             return 0;
           },
@@ -5728,7 +5728,7 @@ var require_client_h1 = __commonJS({
             assert(currentParser.ptr === p);
             return currentParser.onMessageComplete() || 0;
           }
-           
+          /* eslint-enable camelcase */
         }
       });
     }

package.json

@@ -16,7 +16,7 @@
     "node": ">=20"
   },
   "scripts": {
-    "build": "npm run clean && tsup --config tsup.config.ts",
+    "build": "pnpm run clean && tsup --config tsup.config.ts",
     "clean": "rm -rf build dist coverage .vitest",
     "compile": "tsc --outDir build",
     "lint": "mkdir -p build && eslint src tests scripts eslint.config.cjs",
@@ -28,11 +28,11 @@
     "test:watch": "vitest",
     "coverage": "vitest run --coverage",
     "typecheck": "tsc --noEmit",
-    "validate:config": "npm run compile && node scripts/validate-example-config.js",
-    "validate": "npm run validate:config",
-    "check": "npm run lint:ci && npm run format:check && npm run typecheck && npm run test && npm run coverage && npm run build",
-    "prepare": "npm run build",
-    "release-dry-run": "npm run build && npm pack --dry-run"
+    "validate:config": "pnpm run compile && node scripts/validate-example-config.js",
+    "validate": "pnpm run validate:config",
+    "check": "pnpm run lint:ci && pnpm run format:check && pnpm run typecheck && pnpm run test && pnpm run coverage && pnpm run build",
+    "prepare": "pnpm run build",
+    "release-dry-run": "pnpm run build && pnpm pack --dry-run"
   },
   "keywords": [
     "github action",