ci: harden pre-merge checks and supply chain

[jackgranatowski]

This pull request was created by @kiro-agent on behalf of @jackgranatowski 👻

Comment with /kiro fix to address specific feedback or /kiro all to address everything.
_{Learn about Kiro Web}

---

Summary

Strengthens the pre-merge gate and supply-chain posture of the framework CI, and brings it to parity with the SLASHED-Plugins repo.

• CodeQL security analysis added (javascript-typescript + actions), matching the plugins repo. Runs on push, PR, and weekly.
• commitlint job validates PR commits against Conventional Commits — previously only enforced by a local git hook, so commits made via the web UI or without hooks installed slipped through (and they drive the changelog/release).
• npm audit job as a high/critical vulnerability gate.
• Least-privilege top-level permissions: contents: read and PR concurrency cancellation on the CI workflow.
• Dropped the redundant build in the test job (pretest already builds before Playwright).
• Pinned the remaining release.yml actions to commit SHAs (checkout, setup-node, action-gh-release) — ci.yml was already pinned.
• Dependabot now also tracks the npm ecosystem.

Testing

• All workflow YAML validated (parses cleanly).
• npm audit --audit-level=high → 0 vulnerabilities.
• commitlint verified to accept a Conventional message and reject a non-conforming one.

Notes

• For these checks to actually gate merges, add lint, build, test, artifacts-freshness, dependency-audit, commitlint and CodeQL as required status checks in branch protection.
• The commitlint job only runs on pull_request events (it needs a base..head range).

Summary by CodeRabbit

• Chores
  • Enhanced dependency management with automated weekly checks for npm packages.
  • Strengthened CI/CD security by pinning actions to specific commits and disabling dependency caching during publish operations.
  • Implemented commit message validation and dependency security audits in pull requests.
  • Improved workflow efficiency with refined permission controls and concurrency management.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: a31d3066-fe99-47a7-8216-819a079dd030

📥 Commits

Reviewing files that changed from the base of the PR and between 9684819 and 879e733.

📒 Files selected for processing (4)

• .github/dependabot.yml
• .github/workflows/ci.yml
• .github/workflows/publish-dist.yml
• .github/workflows/release.yml

---

📝 Walkthrough

Walkthrough

This PR hardens GitHub Actions workflows and dependency management by adding workflow permissions and concurrency controls, introducing commit message and dependency audit validation jobs, pinning third-party actions to commit SHAs, removing npm caching from publish and release paths to prevent poisoning, and configuring weekly npm ecosystem checks via Dependabot.

Changes

CI/CD Workflow Security and Validation

Layer / File(s)	Summary
CI Workflow Permissions and Concurrency .github/workflows/ci.yml	Default job permissions set to contents: read, and concurrency policy groups runs by workflow+ref while canceling in-progress runs only for pull requests.
CI Validation Jobs: Commit Lint and Dependency Audit .github/workflows/ci.yml	New commitlint job validates PR commit messages over base..head commit range; new dependency-audit job runs npm audit with high/critical advisory threshold; test job refactored to rely on npm test's pretest hook for build automation.
Supply Chain Security: Action Pinning, Cache Removal, and Dependabot .github/dependabot.yml, .github/workflows/publish-dist.yml, .github/workflows/release.yml	Third-party actions in release and sync-main jobs pinned to commit SHAs instead of version tags; npm caching removed from publish-dist and release workflows to prevent cache poisoning; weekly npm ecosystem updates added to Dependabot configuration.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~12 minutes

Possibly related PRs

• codeslash-dev/SLASHED#66: Introduced the publish-dist workflow that is now modified in this PR to remove npm caching.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'ci: harden pre-merge checks and supply chain' accurately summarizes the main changes across multiple CI/CD workflow files, including security hardening (CodeQL, commitlint, npm audit), permission restrictions, action pinning, and Dependabot configuration.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch ci/harden-checks

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[jackgranatowski]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.