Supply chain hardening for pnpm and GitHub Actions

[strickvl]

Summary

Adds supply chain security hardening based on an audit of current configuration against best practices for package cooldowns and dependency management.

Changes

• pnpm-workspace.yaml (new): Configures pnpm v10 supply chain protections:

  • minimumReleaseAge: 10080 — 7-day cooldown before newly published packages can be installed (blocks the window where most compromised packages get detected and yanked)
  • onlyBuiltDependencies: [esbuild] — only esbuild is allowed to run lifecycle scripts (postinstall); all others are blocked
  • blockExoticSubdeps: true — prevents transitive dependencies from pulling code from git repos or tarballs
  • trustPolicy: no-downgrade — blocks package versions that have weaker authentication than prior releases (catches credential compromise)

• GitHub Actions pinned to commit SHAs: All 4 third-party actions (actions/checkout, anthropics/claude-code-action, openai/codex-action, actions/github-script) are pinned to full-length commit SHAs instead of mutable tag refs. This prevents tag hijacking attacks like the tj-actions/changed-files incident that affected 23,000+ repos.

• persist-credentials: false added to all actions/checkout steps to prevent the GITHUB_TOKEN from leaking to subsequent steps.

• .github/dependabot.yml (new): Enables Dependabot for the github-actions ecosystem with weekly checks and a 7-day cooldown on updates.

What's NOT included (follow-up)

• Dependabot for npm ecosystem — tracked in a separate issue for team discussion

Test plan

• Verify pnpm install succeeds locally with the new pnpm-workspace.yaml
• Verify Claude Code and Codex workflows still trigger correctly on PRs (the SHA pins resolve to the same versions currently in use)
• Confirm Dependabot starts opening PRs for GitHub Actions updates after merge