From b2a18b96e745d6ec6a0b9291af0e22605eb09c54 Mon Sep 17 00:00:00 2001
From: Quintin <quintins@uvic.ca>
Date: Thu, 20 Aug 2026 12:07:35 -0700
Subject: [PATCH] Add npm policy, bump CI actions

---
 .github/workflows/docker-publish.yml | 10 ++++++----
 .github/workflows/lint.yml           | 21 +++++++++++++++++----
 .npmrc                               |  5 +++++
 package.json                         |  6 +++++-
 4 files changed, 33 insertions(+), 9 deletions(-)
 create mode 100644 .npmrc

diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml
index e89c9d7..3c4a333 100644
--- a/.github/workflows/docker-publish.yml
+++ b/.github/workflows/docker-publish.yml
@@ -11,16 +11,18 @@ jobs:
   publish-images:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Log in to Docker Hub
-        uses: docker/login-action@v2
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           username: ${{ secrets.pcicdevops_at_dockerhub_username }}
           password: ${{ secrets.pcicdevops_at_dockerhub_password }}
 
       - name: Build and Publish Viewer
-        uses: docker/build-push-action@v4
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         with:
           context: .
           file: ./viewer/Dockerfile
@@ -30,7 +32,7 @@ jobs:
             ${{ github.ref_name == 'main' && 'pcic/pdp-next-viewer:latest' || '' }}
 
       - name: Build and Publish THREDDS
-        uses: docker/build-push-action@v4
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         with:
           context: ./thredds
           file: ./thredds/Dockerfile.thredds
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index e67a07b..6fe75ea 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -18,15 +18,28 @@ jobs:
     name: ESLint
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
         with:
-          node-version: 20
+          node-version: "24"
           cache: npm
 
+      - name: Standardize npm
+        run: npm install --global npm@12
+
+      - name: Verify Node/npm toolchain
+        shell: bash
+        run: |
+          echo "Node: $(node --version)"
+          echo "npm:  $(npm --version)"
+          test "$(node --version | cut -d. -f1 | tr -d v)" = "24"
+          test "$(npm --version | cut -d. -f1)" = "12"
+
       - name: Install dependencies
         run: npm ci
 
       - name: Lint (errors fail, warnings annotate)
-        run: npm run lint:ci
\ No newline at end of file
+        run: npm run lint:ci
diff --git a/.npmrc b/.npmrc
new file mode 100644
index 0000000..f02f7e4
--- /dev/null
+++ b/.npmrc
@@ -0,0 +1,5 @@
+# Repository dependency security policy
+min-release-age=7
+strict-allow-scripts=true
+allow-git=none
+allow-remote=none
diff --git a/package.json b/package.json
index c5c0286..50c2dfe 100644
--- a/package.json
+++ b/package.json
@@ -9,5 +9,9 @@
   "devDependencies": {
     "@eslint/js": "^9.0.0",
     "eslint": "^9.0.0"
+  },
+  "engines": {
+    "node": "24.x",
+    "npm": "12.x"
   }
-}
\ No newline at end of file
+}