Supply chain improvements

[dgreif]

Summary

• Added project npm policy with min-release-age=3.
• Updated Node CI and publish workflows to use Node 26 and npm ci.
• Updated third-party GitHub Actions to current releases pinned by full commit SHA.
• Updated Vitest to 4.1.7 and refreshed package-lock.json with npm audit fix / install.
• Removed token-based npm publish flow in favor of OIDC trusted publishing with provenance.

Ecosystems detected

• npm package with GitHub Actions CI and npm publish workflow.

Recommendations applied

• Node 26 in CI/publish workflows.
• Full-SHA pins for external Actions.
• npm ci in workflow installs.
• npm publish provenance and id-token: write.

Not applied

• No Playwright usage found.
• No Node version files or package engine requirements added.

Human review notes

• npm trusted publishing may need to be configured for @github/memoize before the release workflow can publish without NODE_AUTH_TOKEN.
• Local npm 11.6.0 warned that min-release-age is an unknown config, but commands completed successfully.

Validation

• npm audit fix
• npm install
• npm ci
• npm run build --if-present
• npm test
• npm audit (0 vulnerabilities)

[Copilot]

Pull request overview

This PR tightens the project’s supply-chain posture for the npm package by updating the test toolchain/lockfile, introducing an npm install “cooldown” policy, and hardening GitHub Actions CI/release workflows (newer Node, npm ci, SHA-pinned actions, and OIDC/provenance publishing).

Changes:

• Bump Vitest to 4.1.7 and refresh package-lock.json after audit/install updates.
• Add .npmrc policy (min-release-age=3) intended to reduce exposure to newly-published dependency versions.
• Update CI and publish workflows to Node 26, npm ci, SHA-pinned third-party actions, and npm provenance publishing with id-token: write.

Show a summary per file

File	Description
package.json	Pins Vitest to 4.1.7 to move the test runner/toolchain forward.
package-lock.json	Updates the dependency graph/lockfile to match the new Vitest/tooling versions and audit results.
.npmrc	Adds a minimum release-age policy for dependency installs.
.github/workflows/publish.yml	Moves publishing to Node 26, uses npm ci, SHA-pins actions, and publishes with provenance via OIDC.
.github/workflows/nodejs.yml	Moves CI to Node 26, uses npm ci, and SHA-pins actions.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 4/5 changed files
• Comments generated: 3