ci: Upgrade Yarn to 4.16.0 and align workflows with module template (#204)

## Summary

- Upgrades Yarn from 3.2.1 to 4.16.0 and aligns `.yarnrc.yml` with the
module template (Corepack, `approvedGitRepositories: []`,
`npmMinimalAgeGate: 4320`, `npmPreapprovedPackages`)
- Updates `action-npm-publish` from v1 to v6
- Fully aligns CI workflows with the
[metamask-module-template](https://github.com/MetaMask/metamask-module-template):
- **Added** `main.yml` — top-level orchestration workflow (actionlint,
security scan, build/lint/test, release gating)
- **Added** `build-lint-test.yml` — reusable workflow with
`prepare`/`build`/`lint`/`test`/`compatibility-test` jobs on Node
20/22/24 using `action-checkout-and-setup@v3`
- **Rewrote** `publish-release.yml` as a reusable `workflow_call` —
restructured as `build → publish-npm-dry-run → publish-npm →
publish-release`; GitHub release now happens after npm publish; uses
`action-publish-release@v3`
- **Updated** `create-release-pr.yml` — uses
`action-checkout-and-setup@v3`, `action-create-release-pr@v5`,
`release-type` is now a `choice` input
- **Updated** `publish-preview.yml` — `action-checkout-and-setup@v1` →
`v3`
- **Deleted** `build-test.yml` and `security-code-scanner.yml` —
consolidated into `main.yml`
  - **Added** `actionlint-matcher.json` and `actionlint.yml`
- Adds `lint:changelog` script (`auto-changelog validate --formatter
prettier`) and wires it into `lint` and `lint:fix`

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **Medium Risk**
> Changes npm publish ordering, release gating, and Node matrix
coverage, which can block merges or alter how/when packages ship if
misconfigured.
> 
> **Overview**
> Replaces the monolithic **`build-test.yml`** CI with a **`main.yml`**
entrypoint that runs **actionlint** (with a GitHub problem matcher),
invokes the reusable **MetaMask security scan** workflow, and calls a
new reusable **`build-lint-test.yml`** for prepare/build/lint/test plus
a **lockfile-free compatibility test** on Node **20/22/24** via
**`MetaMask/action-checkout-and-setup@v3`**.
> 
> **Release and publish** behavior shifts: **`publish-release.yml`** is
now **`workflow_call`-only** and runs **`build → npm dry-run → npm
publish → GitHub release`** (GitHub release after npm), using **artifact
upload/download** instead of commit-keyed cache and
**`action-npm-publish@v6`** / **`action-publish-release@v3`**.
**`main.yml`** gates publishing on **`all-jobs-pass`**,
**`action-is-release@v2`**, and **push** events whose head commit author
is **`github-actions`**.
> 
> **`create-release-pr.yml`** moves to
**`action-create-release-pr@v5`**, makes **`release-type`** a **choice**
input (including empty), and drops the release-authors artifact upload.
**`publish-preview.yml`** bumps checkout/setup to **v3**. Adds
**`actionlint.yml`** to ignore the intentional empty **`release-type`**
option.
> 
> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit
9e17710. Bugbot is set up for automated
code reviews on this repo. Configure
[here](https://www.cursor.com/dashboard/bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

Author: Mrtenz

.github/actionlint-matcher.json

@@ -0,0 +1,17 @@
+{
+  "problemMatcher": [
+    {
+      "owner": "actionlint",
+      "pattern": [
+        {
+          "regexp": "^(?:\\x1b\\[\\d+m)?(.+?)(?:\\x1b\\[\\d+m)*:(?:\\x1b\\[\\d+m)*(\\d+)(?:\\x1b\\[\\d+m)*:(?:\\x1b\\[\\d+m)*(\\d+)(?:\\x1b\\[\\d+m)*: (?:\\x1b\\[\\d+m)*(.+?)(?:\\x1b\\[\\d+m)* \\[(.+?)\\]$",
+          "file": 1,
+          "line": 2,
+          "column": 3,
+          "message": 4,
+          "code": 5
+        }
+      ]
+    }
+  ]
+}

.github/actionlint.yml

@@ -0,0 +1,9 @@
+# Please see the documentation for all configuration options:
+# https://github.com/rhysd/actionlint/blob/main/docs/config.md#configuration-file
+
+paths:
+  .github/workflows/create-release-pr.yml:
+    ignore:
+      # `create-release-pr` has an empty string value for the `release-type`
+      # input, which is intentional and valid.
+      - 'string should not be empty'

.github/workflows/build-lint-test.yml

@@ -0,0 +1,120 @@
+name: Build, Lint, and Test
+
+on:
+  workflow_call:
+
+permissions:
+  contents: read
+
+jobs:
+  prepare:
+    name: Prepare
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        node-version: [20.x, 22.x, 24.x]
+    steps:
+      - name: Checkout and setup environment
+        uses: MetaMask/action-checkout-and-setup@v3
+        with:
+          is-high-risk-environment: false
+          node-version: ${{ matrix.node-version }}
+          cache-node-modules: ${{ matrix.node-version == '24.x' }}
+
+  build:
+    name: Build
+    needs: prepare
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        node-version: [24.x]
+    steps:
+      - name: Checkout and setup environment
+        uses: MetaMask/action-checkout-and-setup@v3
+        with:
+          is-high-risk-environment: false
+          node-version: ${{ matrix.node-version }}
+      - run: yarn build
+      - name: Require clean working directory
+        shell: bash
+        run: |
+          if ! git diff --exit-code; then
+            echo "Working tree dirty at end of job"
+            exit 1
+          fi
+
+  lint:
+    name: Lint
+    needs: prepare
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        node-version: [24.x]
+    steps:
+      - name: Checkout and setup environment
+        uses: MetaMask/action-checkout-and-setup@v3
+        with:
+          is-high-risk-environment: false
+          node-version: ${{ matrix.node-version }}
+      - run: yarn lint
+      - name: Validate RC changelog
+        if: ${{ startsWith(github.head_ref, 'release/') }}
+        run: yarn lint:changelog --rc
+      - name: Validate changelog
+        if: ${{ !startsWith(github.head_ref, 'release/') }}
+        run: yarn lint:changelog
+      - name: Require clean working directory
+        shell: bash
+        run: |
+          if ! git diff --exit-code; then
+            echo "Working tree dirty at end of job"
+            exit 1
+          fi
+
+  test:
+    name: Test
+    needs: prepare
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        node-version: [20.x, 22.x, 24.x]
+    steps:
+      - name: Checkout and setup environment
+        uses: MetaMask/action-checkout-and-setup@v3
+        with:
+          is-high-risk-environment: false
+          node-version: ${{ matrix.node-version }}
+      - run: yarn test
+      - name: Require clean working directory
+        shell: bash
+        run: |
+          if ! git diff --exit-code; then
+            echo "Working tree dirty at end of job"
+            exit 1
+          fi
+
+  compatibility-test:
+    name: Compatibility test
+    needs: prepare
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        node-version: [20.x, 22.x, 24.x]
+    steps:
+      - name: Checkout and setup environment
+        uses: MetaMask/action-checkout-and-setup@v3
+        with:
+          is-high-risk-environment: false
+          node-version: ${{ matrix.node-version }}
+      - name: Install dependencies via Yarn
+        run: rm yarn.lock && YARN_ENABLE_IMMUTABLE_INSTALLS=false yarn
+      - run: yarn test
+      - name: Restore lockfile
+        run: git restore yarn.lock
+      - name: Require clean working directory
+        shell: bash
+        run: |
+          if ! git diff --exit-code; then
+            echo "Working tree dirty at end of job"
+            exit 1
+          fi

.github/workflows/build-test.yml

@@ -8,8 +8,14 @@ on:
         default: 'main'
         required: true
       release-type:
-        description: 'A SemVer version diff, i.e. major, minor, patch, prerelease etc. Mutually exclusive with "release-version".'
+        description: 'A SemVer version diff, i.e. major, minor, or patch. Mutually exclusive with "release-version".'
         required: false
+        type: choice
+        options:
+          - ''
+          - major
+          - minor
+          - patch
       release-version:
         description: 'A specific version to bump to. Mutually exclusive with "release-type".'
         required: false
@@ -21,28 +27,22 @@ jobs:
       contents: write
       pull-requests: write
     steps:
-      - uses: actions/checkout@v3
+      - name: Checkout and setup environment
+        uses: MetaMask/action-checkout-and-setup@v3
         with:
-          # This is to guarantee that the most recent tag is fetched.
-          # This can be configured to a more reasonable value by consumers.
+          is-high-risk-environment: true
+
+          # This is to guarantee that the most recent tag is fetched. This can
+          # be configured to a more reasonable value by consumers.
           fetch-depth: 0
+
           # We check out the specified branch, which will be used as the base
           # branch for all git operations and the release PR.
           ref: ${{ github.event.inputs.base-branch }}
-      - name: Setup Node.js
-        uses: actions/setup-node@v3
-        with:
-          node-version-file: '.nvmrc'
-      - uses: MetaMask/action-create-release-pr@v3
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - uses: MetaMask/action-create-release-pr@v5
         with:
           release-type: ${{ github.event.inputs.release-type }}
           release-version: ${{ github.event.inputs.release-version }}
-          artifacts-path: gh-action__release-authors
-      # Upload the release author artifact for use in subsequent workflows
-      - uses: actions/upload-artifact@v4
-        with:
-          name: release-authors
-          path: gh-action__release-authors
-          if-no-files-found: error
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}