feat: Staged publishing, security scanning

+ Minimum package age

Author: timokoessler

.github/workflows/docs.yml

@@ -1,8 +1,8 @@
 name: 📚 Deploy docs
 on:
     push:
-        branches: ['main']
-    workflow_dispatch:
+        branches:
+            - 'main'
 
 # Sets permissions of the GITHUB_TOKEN to allow deployment to GitHub Pages
 permissions:
@@ -24,25 +24,31 @@ jobs:
             url: ${{ steps.deployment.outputs.page_url }}
         runs-on: ubuntu-latest
         steps:
-            - name: Checkout repository ⬇️
+            - name: Checkout repository
               uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
               with:
                   persist-credentials: false
-            - name: Setup Node.js 24 ⚙️
+
+            - name: Setup Node.js 24
               uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
               with:
                   node-version: 24.x
                   cache: 'npm'
-            - name: Install dependencies 📦
+
+            - name: Install dependencies
               run: npm ci
-            - name: Generate docs 📚
+
+            - name: Generate docs
               run: node --run build:docs
-            - name: Setup Pages 📄
+
+            - name: Setup Pages
               uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0
-            - name: Upload artifact ⬆️
+
+            - name: Upload artifact
               uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
               with:
                   path: './docs'
-            - name: Deploy to GitHub Pages 🚀
+
+            - name: Deploy to GitHub Pages
               id: deployment
               uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0

.github/workflows/publish.yml

@@ -8,22 +8,29 @@ jobs:
         permissions:
             contents: read
             id-token: write
+
         steps:
-            - name: Checkout repository ⬇️
+            - name: Checkout repository
               uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
               with:
                   persist-credentials: false
-            - name: Setup Node.js 24 ⚙️
+
+            - name: Setup Node.js 24
               uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
               with:
                   node-version: 24.x
-                  cache: 'npm'
                   registry-url: 'https://registry.npmjs.org'
-            - name: Ensure latest npm version 📦
+                  # Disable caching to prevent cache poisoning attacks
+                  package-manager-cache: false
+
+            - name: Ensure latest npm version
               run: npm install -g npm@latest
-            - name: Install dependencies 📦
+
+            - name: Install dependencies
               run: npm ci
-            - name: Build package 🏗️
+
+            - name: Build package
               run: npm run build
-            - name: Publish to npm 🚀
-              run: npm publish --provenance --access public
+
+            - name: Publish to npm (staged)
+              run: npm stage publish --provenance --access public

.github/workflows/quality.yml

@@ -5,6 +5,7 @@ on:
         branches:
             - 'main'
     pull_request:
+
 permissions:
     contents: read
 
@@ -13,25 +14,25 @@ jobs:
         runs-on: ubuntu-latest
         timeout-minutes: 5
         steps:
-            - name: Checkout repository ⬇️
+            - name: Checkout repository
               uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
               with:
                   persist-credentials: false
 
-            - name: Use Node.js 24.x ⚙️
+            - name: Use Node.js 24.x
               uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
               with:
                   node-version: 24.x
                   cache: 'npm'
 
-            - name: Install dependencies 📦
+            - name: Install dependencies
               run: npm ci
 
-            - name: Run linter 🧹
+            - name: Run linter
               run: node --run lint
 
-            - name: Check formatting ✨
+            - name: Check formatting
               run: node --run check:format
 
-            - name: Check types 🔍
+            - name: Check types
               run: node --run check:types

.github/workflows/security.yml

@@ -0,0 +1,64 @@
+name: Security
+
+on:
+    push:
+        branches:
+            - 'main'
+    pull_request:
+    schedule:
+        - cron: '42 5 * * 2' # Every Tuesday at 5:42am
+
+permissions: {}
+
+jobs:
+    zizmor:
+        name: Check GitHub Actions
+        runs-on: ubuntu-latest
+        timeout-minutes: 15
+        permissions:
+            security-events: write # Required to upload results as security events
+            contents: read
+        steps:
+            - name: Checkout repository
+              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+              with:
+                  persist-credentials: false
+
+            - name: Run zizmor
+              uses: zizmorcore/zizmor-action@5f14fd08f7cf1cb1609c1e344975f152c7ee938d # v0.5.6
+
+    codeql:
+        name: CodeQL (${{ matrix.language }})
+        runs-on: 'ubuntu-latest'
+        permissions:
+            security-events: write
+            packages: read
+            actions: read
+            contents: read
+
+        strategy:
+            fail-fast: false
+            matrix:
+                include:
+                    - language: actions
+                      build-mode: none
+                    - language: javascript-typescript
+                      build-mode: none
+
+        steps:
+            - name: Checkout repository
+              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+              with:
+                  persist-credentials: false
+
+            - name: Initialize CodeQL
+              uses: github/codeql-action/init@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4.36.0
+              with:
+                  languages: ${{ matrix.language }}
+                  build-mode: ${{ matrix.build-mode }}
+                  queries: security-and-quality
+
+            - name: Perform CodeQL Analysis
+              uses: github/codeql-action/analyze@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4.36.0
+              with:
+                  category: '/language:${{matrix.language}}'

.github/workflows/test.yml

@@ -4,27 +4,33 @@ on:
     push:
         branches: ['main']
     pull_request:
+
 permissions:
     contents: read
 
 jobs:
     test:
         runs-on: ubuntu-latest
+        timeout-minutes: 5
         steps:
-            - name: Checkout repository ⬇️
+            - name: Checkout repository
               uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
               with:
                   persist-credentials: false
-            - name: Setup Node.js 24 ⚙️
+
+            - name: Setup Node.js 24
               uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
               with:
                   node-version: 24.x
                   cache: 'npm'
-            - name: Install dependencies 📦
+
+            - name: Install dependencies
               run: npm ci
-            - name: Run tests 🧪
+
+            - name: Run tests
               run: node --run test:cov
+
             - name: Upload coverage report to Codecov 📊
-              uses: codecov/codecov-action@57e3a136b779b570ffcdbf80b3bdc90e7fab3de2 # v6.0.0
+              uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354 # v6.0.1
               with:
                   token: ${{ secrets.CODECOV_TOKEN }}

.npmignore

@@ -14,3 +14,4 @@ CODE_OF_CONDUCT.md
 CONTRIBUTING.md
 .prettierrc.mjs
 .oxlintrc.json
+.npmrc

.npmrc

@@ -0,0 +1,2 @@
+ignore-scripts = true
+min-release-age = 2