Harden pnpm installs against compromised releases

.github/workflows/ci.yml

@@ -10,29 +10,39 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
+# Installs, also nested ones in scripts, skip dependency scripts and pnpmfiles.
+env:
+  pnpm_config_ignore_scripts: "true"
+  pnpm_config_ignore_pnpmfile: "true"
+
 jobs:
   validate:
     name: Validate
     runs-on: ubuntu-latest
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           fetch-depth: 0
+          # Nothing here pushes; keep the token out of .git/config.
+          persist-credentials: false
 
       - name: Setup PNPM
         # v6.1.0 is the first release that installs pnpm 12; the v6 tag still points to 6.0.10.
-        uses: pnpm/action-setup@v6.1.0
+        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
 
       - name: Setup Node
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
         with:
           node-version-file: .nvmrc
           cache: pnpm
 
       - name: Install dependencies
-        run: pnpm install --frozen-lockfile
+        run: pnpm install --frozen-lockfile --ignore-scripts --ignore-pnpmfile
 
       - name: Check changeset
         if: github.event_name == 'pull_request' && !startsWith(github.head_ref, 'changeset-release/')

.github/workflows/release.yml

@@ -10,6 +10,11 @@ concurrency:
 
 permissions: {}
 
+# Installs, also nested ones in scripts, skip pnpmfiles. Dependency scripts are skipped
+# on the install below; the env leaves them on so publishing keeps its lifecycle scripts.
+env:
+  pnpm_config_ignore_pnpmfile: "true"
+
 jobs:
   release-pr:
     name: Release
@@ -24,38 +29,44 @@ jobs:
       # triggers the organization Check like any other pull request.
       - name: Create release token
         id: token
-        uses: actions/create-github-app-token@v3
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
         with:
           client-id: ${{ vars.RELEASE_APP_CLIENT_ID }}
           private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
 
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           fetch-depth: 0
           token: ${{ steps.token.outputs.token }}
+          # Keep the token out of .git/config during the install; Changesets
+          # pushes through the GitHub API instead (commitMode below).
+          persist-credentials: false
 
       - name: Setup PNPM
         # v6.1.0 is the first release that installs pnpm 12; the v6 tag still points to 6.0.10.
-        uses: pnpm/action-setup@v6.1.0
+        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
 
       - name: Setup Node
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
         with:
           node-version-file: .nvmrc
           registry-url: https://registry.npmjs.org
           cache: pnpm
 
       - name: Install dependencies
-        run: pnpm install --frozen-lockfile
+        run: pnpm install --frozen-lockfile --ignore-scripts --ignore-pnpmfile
 
       - name: Create release pull request
         id: changesets
-        uses: changesets/action@v1
+        uses: changesets/action@a45c4d594aa4e2c509dc14a9f2b3b67ba3780d0d # v1.9.0
         with:
           version: pnpm release
           publish: pnpm release:publish
           commit: "[ci] release"
           title: "[ci] release"
+          # Commits and tags go through the GitHub API with the App token, signed
+          # and attributed to the App, so no Git credential is needed in the checkout.
+          commitMode: github-api
         env:
           GITHUB_TOKEN: ${{ steps.token.outputs.token }}

netlify.toml

@@ -3,7 +3,10 @@ command = "pnpm build"
 publish = "apps/docs/dist"
 
 [build.environment]
-NODE_VERSION = "22.18.0"
+NODE_VERSION = "24"
+PNPM_FLAGS = "--frozen-lockfile --ignore-scripts --ignore-pnpmfile"
+pnpm_config_ignore_scripts = "true"
+pnpm_config_ignore_pnpmfile = "true"
 
 [[redirects]]
 from = "/docs/tsx-pages"

pnpm-workspace.yaml

@@ -61,8 +61,12 @@ allowBuilds:
   esbuild: true
   msw: true
 
-# pnpm's supply-chain recommendations (https://pnpm.io/supply-chain-security).
-# blockExoticSubdeps and a one-day minimumReleaseAge are already defaults.
+# Supply-chain protection on top of the pnpm defaults (24h release age, no exotic subdependencies).
+# When only a release under a day old fits, ask (fail in CI) instead of installing it anyway.
+minimumReleaseAgeStrict: true
+# Reject a release published with weaker trust (provenance) than earlier versions.
+# Only releases from the last 7 days are checked, so older ones in existing lockfiles still install.
 trustPolicy: no-downgrade
-# A takeover is found within days, so versions older than 30 days are not held to it.
-trustPolicyIgnoreAfter: 43200
+trustPolicyIgnoreAfter: 10080
+# Never run .pnpmfile hooks.
+ignorePnpmfile: true