chore: harden repository security

[skyrpex]

Motivation

Switching to pnpm for security: unlike npm, pnpm does not run postinstall scripts from dependencies by default, reducing the risk of supply chain attacks.

The CI workflow changes enforce additional security hardening via zizmor (static analysis for GitHub Actions) and pinact (pins actions to full commit SHAs).

Changes

pnpm migration

• Replace package-lock.json with pnpm-lock.yaml (generated via pnpm import)
• Add "packageManager": "pnpm@10.33.3" to package.json
• Update vscode:prepublish, package, and pretest scripts to use pnpm run
• Update CI workflows (build.yml, release.yml) to use pnpm/action-setup, cache: pnpm, and pnpm install --frozen-lockfile

pnpm security policy (pnpm-workspace.yaml)

• Block all dependency build scripts by default (postinstall etc.), with esbuild explicitly allowlisted (required to download its platform binary)
• Enforce trustPolicy: no-downgrade to prevent package version rollbacks
• Enable blockExoticSubdeps: true to block non-standard subdependency specifiers
• Set minimumReleaseAge: 10080 (7 days) to mirror the Dependabot cooldown

CI hardening (zizmor + pinact)

• Pin all GitHub Actions to full commit SHAs via pinact
• set-version action: write to $GITHUB_OUTPUT instead of $GITHUB_ENV to prevent env injection via crafted branch names
• dependabot-auto-merge: replace pull_request_target with pull_request and drop unnecessary checkout step
• release.yml: move permissions from workflow level to per-job scope; set workflow-level permissions: {}

Dependabot

• Add cooldown.default-days: 7 (zizmor best practice) to npm and github-actions ecosystems
• Add github-actions ecosystem tracking

[anisaoshafi]

Thanks a lot Cristian for taking care of security 👏🏼 🔐

❓Shouldn't we also get rid of npx in favor of pnpm in these two publish jobs?

• npx @vscode/vsce publish --packagePath *.vsix
• npx ovsx publish *.vsix -p $OVSX_PAT

[anisaoshafi]

why were some of these settings changed to js/ts format? are these js/ts ones valid vs code settings?

[skyrpex]

Yes, the previous values are deprecated and this is the correct new format. Maybe I should move these changes to a different PR

[skyrpex]

❓Shouldn't we also get rid of npx in favor of pnpm in these two publish jobs?

• npx @vscode/vsce publish --packagePath *.vsix
• npx ovsx publish *.vsix -p $OVSX_PAT

npx is still a good way to run binaries that aren't installed in the repo. Those two are good examples. There is an equivalent in pnpm: pnpm dlx, though. I'll change it.

[anisaoshafi]

LGTM, thanks 🚀