ci: harden npm release pipeline

.github/actions/prepare-runner/action.yml

@@ -4,7 +4,7 @@ runs:
   using: composite
   steps:
     - name: Install Node.js
-      uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
+      uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
       with:
         node-version: 24
     - name: Enable Corepack and pnpm
@@ -13,10 +13,10 @@ runs:
         corepack enable
         corepack install
     - name: Enable pnpm cache
-      uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
+      uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
       with:
         node-version: 24
         cache: pnpm
     - name: Install dependencies
       shell: bash
-      run: pnpm install --frozen-lockfile
+      run: pnpm install --frozen-lockfile --ignore-scripts

.github/workflows/check-workflows.yml

@@ -0,0 +1,24 @@
+name: Lint CI workflows
+on:
+  push:
+    branches: ["main"]
+  pull_request:
+    branches: ["**"]
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  zizmor:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      actions: read
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Run zizmor
+        uses: zizmorcore/zizmor-action@6599ee8b7a49aef6a770f63d261d214911a7ce02 # v0.6.0
+        with:
+          advanced-security: false

.github/workflows/deploy-docs.yml

@@ -5,20 +5,19 @@ on:
     branches: [main, docs]
   workflow_dispatch:
 
-permissions:
-  contents: read
-  pages: write
-  id-token: write
-
 concurrency:
   group: pages
   cancel-in-progress: true
 
 jobs:
   build:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - uses: ./.github/actions/prepare-runner
 
@@ -32,6 +31,10 @@ jobs:
   deploy:
     needs: build
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pages: write
+      id-token: write
     environment:
       name: github-pages
       url: ${{ steps.deployment.outputs.page_url }}

.github/workflows/lint.yml

@@ -10,9 +10,13 @@ concurrency:
 jobs:
   lint:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     env:
       CI_RUN: true
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - uses: ./.github/actions/prepare-runner
       - run: pnpm lint

.github/workflows/pkg-check.yml

@@ -10,10 +10,14 @@ concurrency:
 jobs:
   pkg-check:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     env:
       CI_RUN: true
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - uses: ./.github/actions/prepare-runner
       - run: pnpm --filter nanotags run build
       - run: pnpm --filter nanotags exec publint

.github/workflows/publish.yml

@@ -4,17 +4,77 @@ on:
   push:
     tags:
       - "[0-9]+.[0-9]+.[0-9]+"
-env:
-  CI_RUN: true
+
 jobs:
-  publish-npm:
+  test:
     runs-on: ubuntu-latest
     permissions:
       contents: read
-      id-token: write
+    env:
+      CI_RUN: true
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - uses: ./.github/actions/prepare-runner
+      - run: pnpm test
+
+  build: # Separate job so build-time dependencies can't publish
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    env:
+      CI_RUN: true
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Install Node.js
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 24
+          package-manager-cache: false # Slower, but no cache poisoning risk
+      - name: Enable Corepack and pnpm
+        shell: bash
+        run: |
+          corepack enable
+          corepack install
+      - run: pnpm install --frozen-lockfile --ignore-scripts
       - run: pnpm --filter nanotags build
       - run: cp README.md LICENSE.md packages/nanotags/
-      - run: pnpm --filter nanotags publish --no-git-checks --provenance
+      - name: Upload build artifacts
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: build-artifacts
+          path: |
+            packages/nanotags/dist/
+            packages/nanotags/README.md
+            packages/nanotags/LICENSE.md
+          if-no-files-found: error
+          retention-days: 1
+
+  publish: # The critical job: no dependencies installed at all
+    runs-on: ubuntu-latest
+    needs:
+      - test
+      - build
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Download build artifacts
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: build-artifacts
+          path: packages/nanotags
+      - name: Install Node.js
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 26 # Bundles npm 11.17+, which has `npm stage`
+          package-manager-cache: false
+      - name: Stage npm release for manual approval
+        working-directory: packages/nanotags
+        run: npm stage publish --ignore-scripts

.github/workflows/size-limit.yml

@@ -7,24 +7,27 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
-permissions:
-  pull-requests: write
-
 jobs:
   sizecheck:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
     env:
       CI_RUN: true
       CI_JOB_NUMBER: 1
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 24
+          package-manager-cache: false
       - shell: bash
         run: |
           corepack enable
-          corepack prepare pnpm@latest --activate
+          corepack install
       - uses: andresz1/size-limit-action@94bc357df29c36c8f8d50ea497c3e225c3c95d1d # v1.8.0
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/test.yml

@@ -10,9 +10,13 @@ concurrency:
 jobs:
   test:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     env:
       CI_RUN: true
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - uses: ./.github/actions/prepare-runner
       - run: pnpm test

.github/workflows/typecheck.yml

@@ -10,9 +10,13 @@ concurrency:
 jobs:
   typecheck:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     env:
       CI_RUN: true
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - uses: ./.github/actions/prepare-runner
       - run: pnpm typecheck

pnpm-workspace.yaml

@@ -1,3 +1,4 @@
 packages:
   - "packages/*"
   - "apps/*"
+minimumReleaseAge: 4320