3 people f2f46687ac Verify npm dependency signatures before builds (#426) ...

## Summary

Supersedes #402 with its changes rebased onto current `main` and the
merge conflict resolved. The original PR is left unchanged.

- Run `npm audit signatures` after installation and before `npm run all`
in the test and checksum-update workflows.
- Preserve the current JSON checksum manifest path
(`src/download/checksum/known-checksums.json`).
- Verify registry signatures and available provenance attestations
without requiring every dependency to publish provenance.

Related: astral-sh/setup-uv#1027 adds the same verification; #401
separately hardens npm installation defaults.

## Validation

Using Node 24.19.0 (matching `.nvmrc`) and npm 11.10.0:
- `npm ci --ignore-scripts` passed (reports existing dependency
vulnerabilities; dependency files are unchanged).
- `npm audit signatures` passed: 547 registry signatures and 97
attestations verified.
- `npm run all` passed: 7 suites, 99 tests; no generated or formatting
changes.
- `actionlint` passed.
- `zizmor` reports the same 26 low-severity findings on this branch and
`main`, with no new findings.
- `git diff --check` passed.

Refs: pi-session 01a1399e-1a99-7314-9573-9a982ea1bb3f

Co-authored-by: zaniebot <242828183+zaniebot@users.noreply.github.com>

2026-10-14 11:05:12 +02:00

..

codeql-analysis.yml

chore: roll up Dependabot updates (#386)

2026-07-05 12:04:11 +02:00

release-drafter.yml

chore(deps): bump release-drafter/release-drafter from 7.3.0 to 7.6.0 (#404)

2026-09-03 16:43:22 +05:30

release.yml

Update the release process to match setup-uv (#364)

2026-04-27 10:31:05 -05:00

test.yml

Verify npm dependency signatures before builds (#426)

2026-10-14 11:05:12 +02:00

update-known-checksums.yml

Verify npm dependency signatures before builds (#426)

2026-10-14 11:05:12 +02:00

update-major-minor-tags.yml

fix: persist credentials for git push in update-major-minor-tags workflow (#312)

2026-01-30 19:43:42 +01:00