Supply-chain hardening: blockExoticSubdeps, SHA-pinned actions, least-privilege CI, GHA cooldown

.github/dependabot.yml

@@ -43,3 +43,11 @@ updates:
       # bump it by hand when moving to the next Node LTS.
       - dependency-name: "@types/node"
         update-types: ["version-update:semver-major"]
+
+  - package-ecosystem: "github-actions" # bumps SHA-pinned actions, keeps # vX comment
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    cooldown:
+      default-days: 7 # min-release-age equivalent for GHA: wait out same-day yanks
+    open-pull-requests-limit: 10

.github/workflows/ci.yml

@@ -5,29 +5,34 @@ on:
     branches: [main]
   pull_request:
 
+# Least privilege: this workflow only reads the repo.
+permissions:
+  contents: read
+
 jobs:
   validate:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           # Full history so diff-cover can find the merge-base with the PR base branch.
           fetch-depth: 0
+          persist-credentials: false
 
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
         with:
           node-version-file: .nvmrc
 
       # Reads the pnpm version from the "packageManager" field in package.json.
-      - uses: pnpm/action-setup@v6
+      - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
 
       # Manual cache (instead of setup-node's built-in cache: pnpm) so we can
       # use restore-keys for warm/partial restores when the lockfile changes.
       - name: Locate pnpm store
         shell: bash
         run: echo "STORE_PATH=$(pnpm store path --silent)" >> "$GITHUB_ENV"
 
-      - uses: actions/cache@v5
+      - uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
         with:
           path: ${{ env.STORE_PATH }}
           key: ${{ runner.os }}-pnpm-store-${{ hashFiles('pnpm-lock.yaml') }}
@@ -64,15 +69,15 @@ jobs:
       # the git diff against the base branch (no baseline or second run needed).
       - name: Diff coverage
         run: |
-          pipx run diff-cover coverage/lcov.info \
+          pipx run diff-cover==10.5.1 coverage/lcov.info \
             --compare-branch origin/${{ github.base_ref || 'main' }} \
             --fail-under 80
 
       - name: Build
         run: pnpm build
 
       - name: Cache Playwright browsers
-        uses: actions/cache@v5
+        uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
         with:
           path: ~/.cache/ms-playwright
           key: ${{ runner.os }}-playwright-${{ hashFiles('pnpm-lock.yaml') }}
@@ -87,7 +92,7 @@ jobs:
       - name: E2E
         run: pnpm test:e2e
 
-      - uses: actions/upload-artifact@v7
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         if: ${{ failure() }}
         with:
           name: playwright-report

.github/workflows/update-pnpm.yml

@@ -18,10 +18,13 @@ jobs:
   update:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        with:
+          # create-pull-request authenticates with the App token, not persisted creds.
+          persist-credentials: false
 
       # Pin Node to the repo's version so the registry query runs deterministically.
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
         with:
           node-version-file: .nvmrc
 
@@ -54,7 +57,7 @@ jobs:
       - name: Generate App token
         if: steps.versions.outputs.changed == 'true'
         id: app-token
-        uses: actions/create-github-app-token@v3
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
         with:
           client-id: ${{ vars.APP_CLIENT_ID }}
           private-key: ${{ secrets.APP_PRIVATE_KEY }}
@@ -63,7 +66,7 @@ jobs:
 
       - name: Create pull request
         if: steps.versions.outputs.changed == 'true'
-        uses: peter-evans/create-pull-request@v8
+        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
         with:
           token: ${{ steps.app-token.outputs.token }}
           commit-message: "chore: update pnpm to ${{ steps.versions.outputs.latest }}"

package.json

@@ -66,7 +66,8 @@
     "typescript": "npm:@typescript/typescript6@^6.0.2",
     "vite": "^8.3.0",
     "vitest": "^4.1.11",
-    "vitest-axe": "^0.1.0"
+    "vitest-axe": "^0.1.0",
+    "yaml": "^2.9.0"
   },
   "packageManager": "[email protected]"
 }