From 0e7583203812f9994a50357130e9f492e2a74f53 Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Fri, 9 Oct 2026 00:13:30 +0000 Subject: [PATCH 1/2] ci: install from the frozen lockfile The test, coverage, and release workflows install with pnpm install --frozen-lockfile. The lockfile is committed. Co-authored-by: Jared Wray --- .github/workflows/code-coverage.yaml | 2 +- .github/workflows/release.yaml | 2 +- .github/workflows/tests.yaml | 2 +- DEFENSE_IN_DEPTH.md | 4 ++-- 4 files changed, 5 insertions(+), 5 deletions(-) diff --git a/.github/workflows/code-coverage.yaml b/.github/workflows/code-coverage.yaml index bfc1b3a..54e690c 100644 --- a/.github/workflows/code-coverage.yaml +++ b/.github/workflows/code-coverage.yaml @@ -35,7 +35,7 @@ jobs: cache: 'pnpm' - name: Install Dependencies - run: pnpm install + run: pnpm install --frozen-lockfile - name: Build run: pnpm build diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index 4ba47d9..3d4298f 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -35,7 +35,7 @@ jobs: cache: 'pnpm' - name: Install Dependencies - run: pnpm install + run: pnpm install --frozen-lockfile - name: Build run: pnpm build diff --git a/.github/workflows/tests.yaml b/.github/workflows/tests.yaml index 81c6bda..44da9d9 100644 --- a/.github/workflows/tests.yaml +++ b/.github/workflows/tests.yaml @@ -39,7 +39,7 @@ jobs: cache: 'pnpm' - name: Install Dependencies - run: pnpm install + run: pnpm install --frozen-lockfile - name: Build run: pnpm build diff --git a/DEFENSE_IN_DEPTH.md b/DEFENSE_IN_DEPTH.md index 20dd8d1..fe77f20 100644 --- a/DEFENSE_IN_DEPTH.md +++ b/DEFENSE_IN_DEPTH.md @@ -20,8 +20,8 @@ Profile: npm library · public - [x] 7-day cooldown: `minimumReleaseAge: 10080`, `minimumReleaseAgeStrict: true`, `minimumReleaseAgeIgnoreMissingTime: false`; no first-party `minimumReleaseAgeExclude` — PR #162 - [x] `trustPolicy: no-downgrade`; no first-party `trustPolicyExclude` — PR #163 - [x] Lifecycle scripts blocked: `strictDepBuilds: true`, `dangerouslyAllowAllBuilds: false`, `allowBuilds: {}` baseline — PR #164 -- [ ] `blockExoticSubdeps: true` (PR #165 pending) -- [ ] Lockfile committed; CI installs with `pnpm install --frozen-lockfile` +- [x] `blockExoticSubdeps: true` — PR #165 +- [ ] Lockfile committed; CI installs with `pnpm install --frozen-lockfile` (PR pending) - [x] No `.github/dependabot.yml`; other dependency-update tools (if any) open PRs only — never auto-merge — verified 2026-10-08 ## 4. GitHub Actions From b7db70169aed27cfc7763948823423b10a841e20 Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Fri, 9 Oct 2026 00:13:43 +0000 Subject: [PATCH 2/2] docs: record pull request 166 on the frozen lockfile item The checklist names the open pull request. Co-authored-by: Jared Wray --- DEFENSE_IN_DEPTH.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/DEFENSE_IN_DEPTH.md b/DEFENSE_IN_DEPTH.md index fe77f20..4ecad6e 100644 --- a/DEFENSE_IN_DEPTH.md +++ b/DEFENSE_IN_DEPTH.md @@ -21,7 +21,7 @@ Profile: npm library · public - [x] `trustPolicy: no-downgrade`; no first-party `trustPolicyExclude` — PR #163 - [x] Lifecycle scripts blocked: `strictDepBuilds: true`, `dangerouslyAllowAllBuilds: false`, `allowBuilds: {}` baseline — PR #164 - [x] `blockExoticSubdeps: true` — PR #165 -- [ ] Lockfile committed; CI installs with `pnpm install --frozen-lockfile` (PR pending) +- [ ] Lockfile committed; CI installs with `pnpm install --frozen-lockfile` (PR #166 pending) - [x] No `.github/dependabot.yml`; other dependency-update tools (if any) open PRs only — never auto-merge — verified 2026-10-08 ## 4. GitHub Actions