chore(ci): harden supply-chain workflows

.github/dependabot.yml

@@ -0,0 +1,22 @@
+version: 2
+updates:
+  - package-ecosystem: "npm"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5
+    cooldown:
+      default-days: 7
+    groups:
+      production-dependencies:
+        dependency-type: "production"
+      development-dependencies:
+        dependency-type: "development"
+
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5
+    cooldown:
+      default-days: 7

.github/scripts/wait-for-workflow.sh

@@ -0,0 +1,52 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+workflow_file="${1:?workflow file is required}"
+branch_name="${2:?branch name is required}"
+commit_sha="${3:?commit sha is required}"
+poll_seconds="${4:-10}"
+max_attempts="${5:-60}"
+
+echo "Waiting for ${workflow_file} on ${branch_name}@${commit_sha}"
+
+for attempt in $(seq 1 "${max_attempts}"); do
+  run_json="$(
+    gh run list \
+      --workflow "${workflow_file}" \
+      --branch "${branch_name}" \
+      --commit "${commit_sha}" \
+      --event push \
+      --limit 20 \
+      --json databaseId,headSha,status,conclusion \
+      --jq 'map(select(.headSha == "'"${commit_sha}"'")) | first'
+  )"
+
+  if [[ -z "${run_json}" || "${run_json}" == "null" ]]; then
+    echo "Attempt ${attempt}/${max_attempts}: workflow run not found yet."
+    sleep "${poll_seconds}"
+    continue
+  fi
+
+  run_id="$(jq -r '.databaseId' <<<"${run_json}")"
+  run_status="$(jq -r '.status' <<<"${run_json}")"
+  run_conclusion="$(jq -r '.conclusion // empty' <<<"${run_json}")"
+
+  echo "Attempt ${attempt}/${max_attempts}: run=${run_id} status=${run_status} conclusion=${run_conclusion:-pending}"
+
+  if [[ "${run_status}" != "completed" ]]; then
+    sleep "${poll_seconds}"
+    continue
+  fi
+
+  if [[ "${run_conclusion}" == "success" ]]; then
+    echo "${workflow_file} succeeded for ${commit_sha}"
+    exit 0
+  fi
+
+  echo "${workflow_file} concluded with ${run_conclusion} for ${commit_sha}"
+  exit 1
+done
+
+echo "Timed out while waiting for ${workflow_file} on ${commit_sha}"
+exit 1

.github/workflows/build-docs.yaml

@@ -5,10 +5,7 @@ on:
     types: [ published ]
   workflow_dispatch:
 
-permissions:
-  contents: read
-  pages: write
-  id-token: write
+permissions: {}
 
 concurrency:
   group: pages
@@ -18,27 +15,31 @@ jobs:
   build-docs:
     if: ${{ !github.event.release.prerelease }}
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
-    - name: Checkout
-      uses: actions/checkout@v6
-    - name: Setup pnpm
-      uses: pnpm/action-setup@v5
-    - name: Setup Node.js
-      uses: actions/setup-node@v6
-      with:
-        node-version: 18
-        cache: pnpm
-        cache-dependency-path: pnpm-lock.yaml
-    - name: Setup Pages
-      uses: actions/configure-pages@v6
-    - name: Install dependencies
-      run: pnpm install --frozen-lockfile
-    - name: Build docs
-      run: pnpm run docs
-    - name: Upload Pages artifact
-      uses: actions/upload-pages-artifact@v4
-      with:
-        path: docs
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
+      - name: Setup pnpm
+        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
+        with:
+          run_install: false
+      - name: Setup Node.js
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
+        with:
+          node-version: 18
+      - name: Setup Pages
+        uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+      - name: Build docs
+        run: pnpm run docs
+      - name: Upload Pages artifact
+        uses: actions/upload-pages-artifact@7b1f4a764d45c48632c6b24a0339c27f5614fb0b # v4
+        with:
+          path: docs
 
   deploy:
     if: ${{ !github.event.release.prerelease }}
@@ -47,7 +48,10 @@ jobs:
       url: ${{ steps.deployment.outputs.page_url }}
     runs-on: ubuntu-latest
     needs: build-docs
+    permissions:
+      pages: write
+      id-token: write
     steps:
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@v5
+        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5

.github/workflows/ci.yml

@@ -7,8 +7,7 @@ on:
     branches: [master, beta]
   workflow_dispatch:
 
-permissions:
-  contents: read
+permissions: {}
 
 concurrency:
   group: ci-${{ github.ref }}
@@ -18,21 +17,56 @@ env:
   FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
 
 jobs:
-  ci:
-    name: CI (Node ${{ matrix.node-version }})
+  lint:
+    name: Lint
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
+        with:
+          run_install: false
+
+      - name: Setup Node.js
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
+        with:
+          node-version: 18
+          cache: pnpm
+          cache-dependency-path: pnpm-lock.yaml
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Lint
+        run: pnpm lint:ci
+
+  test-matrix:
+    name: Test Matrix (Node ${{ matrix.node-version }})
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
     strategy:
       matrix:
         node-version: [18, 20, 22]
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@v5
+        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
+        with:
+          run_install: false
 
       - name: Setup Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
         with:
           node-version: ${{ matrix.node-version }}
           cache: pnpm
@@ -41,11 +75,48 @@ jobs:
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
 
-      - name: Lint
-        run: pnpm lint:ci
-
       - name: Test (unit only)
         run: pnpm test:ci
 
+  test:
+    name: Test
+    if: ${{ always() }}
+    needs: test-matrix
+    runs-on: ubuntu-latest
+    steps:
+      - name: Verify matrix result
+        run: |
+          if [ "${{ needs.test-matrix.result }}" != "success" ]; then
+            echo "::error::At least one Node compatibility test failed."
+            exit 1
+          fi
+
+  build:
+    name: Build
+    needs: [lint, test]
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
+        with:
+          run_install: false
+
+      - name: Setup Node.js
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
+        with:
+          node-version: 18
+          cache: pnpm
+          cache-dependency-path: pnpm-lock.yaml
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
       - name: Build
         run: pnpm tsup