zaniebotandzaniebot f8c88970fc Verify npm dependency signatures before builds (#1027) ...

CI installs the locked npm dependency tree without running lifecycle
scripts, but it does not verify registry signatures or available
provenance attestations. Run `npm audit signatures` after installation
in both the test and checksum-update workflows, before `npm run all`
executes dependency tooling. The check follows npm's registry-signature
support and verifies attestations when present; it does not require
every dependency to publish provenance.

Related: astral-sh/ruff-action#402 adds the same signature and
provenance verification. astral-sh/setup-uv#1026 separately hardens
`npm` install defaults.

Co-authored-by: zaniebot <242828183+zaniebot@users.noreply.github.com>

2026-10-14 10:52:00 +02:00

..

codeql-analysis.yml

chore(deps): roll up Dependabot updates (#1059)

2026-09-21 08:40:50 +02:00

release-drafter.yml

chore(deps): roll up Dependabot updates (#994)

2026-08-11 11:27:16 +02:00

release.yml

Use self-repo syntax for all in-repo actions/reusable workflows (#1024)

2026-08-16 22:14:36 +02:00

test.yml

Verify npm dependency signatures before builds (#1027)

2026-10-14 10:52:00 +02:00

update-docs.yml

ci: remove obsolete direct push attempts (#1019)

2026-08-14 11:40:50 +02:00

update-known-checksums.yml

Verify npm dependency signatures before builds (#1027)

2026-10-14 10:52:00 +02:00