chore: supply-chain hardening

.github/dependabot.yml

@@ -0,0 +1,16 @@
+version: 2
+updates:
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: weekly
+    cooldown:
+      default-days: 7
+    open-pull-requests-limit: 10
+
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    cooldown:
+      default-days: 7

.github/workflows/check-adapters.yml

@@ -1,7 +1,7 @@
 name: Check Adapters
 
 permissions:
-  contents: write
+  contents: read
 
 on:
   push:
@@ -15,9 +15,11 @@ on:
 jobs:
   run-checks:
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           submodules: false
           fetch-depth: 0
@@ -44,9 +46,9 @@ jobs:
           git diff --quiet && git diff --staged --quiet || (git commit -m "Reset euler-interfaces submodule" && git push)
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
-          node-version: "20"
+          node-version-file: .nvmrc
           cache: "npm"
 
       - name: Generate .env file
@@ -78,7 +80,7 @@ jobs:
       # 🆕 NEW STEP: Sync /data folder to AWS S3
       - name: Sync data to S3
         if: success()  # only run if all previous steps passed
-        uses: jakejarvis/s3-sync-action@v0.5.1
+        uses: jakejarvis/s3-sync-action@be0c4ab89158cac4278689ebedd8407dd5f35a83 # v0.5.1
         with:
           args: --follow-symlinks --delete
         env:

.github/workflows/ci.yml

@@ -0,0 +1,41 @@
+name: CI
+
+on:
+  push:
+    branches: [master]
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  verify:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        with:
+          fetch-depth: 0
+
+      - name: Setup Node
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        with:
+          node-version-file: .nvmrc
+          cache: npm
+
+      - name: Install (frozen lockfile)
+        run: npm ci
+
+      - name: Lockfile-drift check
+        run: |
+          set -euo pipefail
+          base="${{ github.event.pull_request.base.sha || 'HEAD~1' }}"
+          lock_changed=$(git diff --name-only "$base" HEAD -- package-lock.json | wc -l | tr -d ' ')
+          manifest_changed=$(git diff --name-only "$base" HEAD -- 'package.json' | wc -l | tr -d ' ')
+          if [ "$lock_changed" != "0" ] && [ "$manifest_changed" = "0" ]; then
+            echo "::error::Lockfile changed with no matching package.json change — refusing to merge."
+            exit 1
+          fi
+
+      - name: Audit (high+)
+        run: npm audit --audit-level=high

.npmrc

@@ -0,0 +1,5 @@
+audit-level=high
+engine-strict=true
+save-exact=true
+fund=false
+min-release-age=7

.nvmrc

@@ -0,0 +1 @@
+22