From 7e2e66f5ef149638676a476edc9c2761d766667d Mon Sep 17 00:00:00 2001
From: Julius Walton <juliuswalton7901@gmail.com>
Date: Thu, 4 Jun 2026 01:00:27 -0400
Subject: [PATCH] Harden CI workflow (least-privilege, SHA-pinned actions,
 concurrency)

- Add a least-privilege `permissions: contents: read` block.
- Pin actions to commit SHAs and move to v6 (runs on the Node 24 action runtime, clearing the Node 20 deprecation warning).
- Cancel superseded runs for the same ref via concurrency.
- Add .nvmrc (24) and a package.json engines floor (>=22).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 .github/workflows/ci.yml | 16 ++++++++++++++--
 .nvmrc                   |  1 +
 package.json             |  3 +++
 3 files changed, 18 insertions(+), 2 deletions(-)
 create mode 100644 .nvmrc

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index c817ecc..cef5772 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -5,13 +5,25 @@ on:
     branches: [main]
   pull_request:
 
+# Least privilege: this workflow only needs to read the repo.
+permissions:
+  contents: read
+
+# Cancel superseded runs for the same ref to save CI minutes.
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   check:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      # Actions are pinned to commit SHAs (supply-chain hardening); the
+      # trailing comment records the human-readable version. v6 runs on the
+      # Node 24 action runtime, clearing the Node 20 deprecation warning.
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: 24
           cache: npm
diff --git a/.nvmrc b/.nvmrc
new file mode 100644
index 0000000..a45fd52
--- /dev/null
+++ b/.nvmrc
@@ -0,0 +1 @@
+24
diff --git a/package.json b/package.json
index b0b197c..c58e4bc 100644
--- a/package.json
+++ b/package.json
@@ -3,6 +3,9 @@
   "version": "1.1.0",
   "description": "Dev tooling for the GitHub PR Reverse Comments browser extension. The extension itself has no build step; these scripts only lint, format, test, and package it.",
   "private": true,
+  "engines": {
+    "node": ">=22"
+  },
   "scripts": {
     "lint": "eslint .",
     "format": "prettier --write .",