zaniebotandzaniebot f8c88970fc Verify npm dependency signatures before builds (#1027) ...

CI installs the locked npm dependency tree without running lifecycle
scripts, but it does not verify registry signatures or available
provenance attestations. Run `npm audit signatures` after installation
in both the test and checksum-update workflows, before `npm run all`
executes dependency tooling. The check follows npm's registry-signature
support and verifies attestations when present; it does not require
every dependency to publish provenance.

Related: astral-sh/ruff-action#402 adds the same signature and
provenance verification. astral-sh/setup-uv#1026 separately hardens
`npm` install defaults.

Co-authored-by: zaniebot <242828183+zaniebot@users.noreply.github.com>

2026-10-14 10:52:00 +02:00

..

scripts

Replace inline compile args with tsconfig (#824)

2026-03-28 16:19:09 +01:00

workflows

Verify npm dependency signatures before builds (#1027)

2026-10-14 10:52:00 +02:00

actionlint.yaml

Use self-repo syntax for all in-repo actions/reusable workflows (#1024)

2026-08-16 22:14:36 +02:00

dependabot.yml

Add dependency cooldowns (#1021)

2026-08-16 21:41:43 +02:00

python.json

Bump biome to v2 (#515)

2025-08-12 20:12:10 +00:00

release-drafter.yml

Use astral-sh/versions as primary version provider (#802)

2026-03-12 22:03:21 +01:00