[CallumHoward]

Supply-chain hardening for pnpm and CI.

• 651345a blockExoticSubdeps: true: transitive deps must resolve from the registry, not git/tarball URLs. This is already the pnpm 11 default; setting it explicitly documents intent and lets the config guard catch a future default change.
• 96a4b94 CI hardening:
  • ci.yml gets top-level permissions: contents: read.
  • Every action in both workflows is pinned to a tagged release's commit SHA with an exact # vX.Y.Z comment (all releases are >7 days old), so a moved or compromised tag can't change what runs. Majors are unchanged; Dependabot handles bumps.
  • persist-credentials: false on both checkouts. Neither workflow pushes with GITHUB_TOKEN; create-pull-request uses the App token.
  • diff-cover pinned to 10.5.1 (pipx run otherwise pulls latest from PyPI each run).
  • New github-actions Dependabot block with a 7-day cooldown, matching the npm cooldown.
• 846415d src/lib/supply-chain-config.test.ts parses pnpm-workspace.yaml (new yaml devDep) and asserts trustPolicy, blockExoticSubdeps, minimumReleaseAge, minimumReleaseAgeStrict, and no global build allowlist. pnpm ignores unknown keys silently, so a typo'd or removed setting would otherwise go unnoticed.

Git/tarball deps and mutable action tags both skip registry and provenance checks, which minimumReleaseAge and trustPolicy don't cover.

Follow-ups (not in this PR)

• Enable the repo setting that requires actions to be pinned to full-length SHAs (sha_pinning_required), so future unpinned uses: fail instead of relying on review.
• diff-cover isn't tracked by Dependabot; bump it by hand.

Verification

• pnpm install --frozen-lockfile passes the supply-chain policies; the only new dep is yaml.
• Each config guard fails when its setting is broken and passes when restored.
• Rebased onto main (cca6ad3); peers, typecheck, lint, format, fallow, tests and build pass locally.

🤖 Generated with Claude Code

[Copilot]

Copilot review overview

🟡 Changes recommended

Explicit strict release-age and complete build-policy regression checks are still needed.

Review effort: Lite
Findings: 1

Open (1)

• Require minimumReleaseAgeStrict to be explicitly true · New

What changed in this PR

Hardens pnpm dependency resolution and GitHub Actions against supply-chain risks.

Changes:

• Adds pnpm policy configuration and regression tests.
• SHA-pins workflow actions, restricts permissions, and disables persisted credentials.
• Pins diff-cover and adds GitHub Actions Dependabot cooldowns.

File	Summary
src/​lib/​supply-chain-config.test.ts	Adds configuration guards; strict mode and build-policy assertions need strengthening, including wildcard rejection.
pnpm-workspace.yaml	Enables exotic-subdependency blocking; explicitly configure strict release-age enforcement.
pnpm-lock.yaml	Locks the new YAML dependency.
package.json	Adds yaml as a development dependency.
.github/​workflows/​update-pnpm.yml	Pins actions and disables persisted checkout credentials.
.github/​workflows/​ci.yml	Hardens permissions, action references, credentials, and tooling.
.github/​dependabot.yml	Adds GitHub Actions updates with cooldown.

Files not reviewed (1)

• pnpm-lock.yaml: Generated file

---

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.