Supply chain improvements

[dgreif]

Summary

• Added project npm config with min-release-age=3.
• Updated Node CI to use Node 26, npm ci, npm caching, least-privilege permissions, and pinned GitHub Actions SHAs.
• Updated publish workflows to use Node 26 and pinned GitHub Actions SHAs while keeping OIDC/provenance publishing.
• Refreshed the package lockfile with the package version from package.json.

Ecosystems detected

• npm package
• GitHub Actions CI and publish workflows

Recommendations applied

• npm minimum release age configured.
• Third-party actions pinned to full commit SHAs using current known releases.
• CI install changed from npm it/install behavior to explicit npm ci plus npm test.
• Release workflows updated from Node 24 to Node 26.

Not applied

• No Vitest or Playwright configuration was present.
• No Node version requirement files or package engine fields were added.

Human review notes

• npm trusted publishing may need to be configured for the package before OIDC publishing succeeds.

Validation

• npm install --no-audit --no-fund
• npm audit fix
• npm ci
• npm test
• npm audit

[Copilot]

Pull request overview

This PR strengthens the repo’s npm and GitHub Actions supply-chain posture by introducing an npm minimum release age gate, pinning third-party actions to full commit SHAs, modernizing CI/release workflows (Node 26 + npm ci + caching + least-privilege permissions), and syncing the lockfile metadata to the package version.

Changes:

• Added .npmrc configuration to enforce a minimum release age for installed packages.
• Updated CI and publish workflows to Node 26, npm ci/npm test, npm caching, and pinned action SHAs.
• Refreshed package-lock.json to match the package.json version.

Show a summary per file

File	Description
package-lock.json	Synces lockfile metadata (version) with package.json.
.npmrc	Adds an npm config gate (min-release-age=3) to reduce risk from newly published deps.
.github/workflows/test.yml	Updates CI to Node 26, npm ci, npm caching, least-privilege permissions, and pinned action SHAs.
.github/workflows/publish.yml	Updates release publishing jobs to Node 26 and pinned action SHAs while keeping OIDC/provenance publishing.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 3/4 changed files
• Comments generated: 1