ci: harden release pipeline against supply-chain

.github/workflows/ci-cd.yml

@@ -6,15 +6,17 @@ on:
   pull_request:
     branches:
       - main
+permissions:
+  contents: read
 jobs:
   format-and-lint:
     name: Check formatting and lint
     runs-on: ubuntu-latest
     steps:
       - name: Clone repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
       - name: Setup Deno
-        uses: denoland/setup-deno@v2
+        uses: denoland/setup-deno@667a34cdef165d8d2b2e98dde39547c9daac7282 # v2
         with:
           deno-version: v2.x
           cache: true
@@ -31,21 +33,21 @@ jobs:
         os: [ubuntu-latest, macos-latest, windows-latest]
     steps:
       - name: Clone repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
       - name: Setup Deno (Ubuntu/macOS)
         if: matrix.os != 'windows-latest'
-        uses: denoland/setup-deno@v2
+        uses: denoland/setup-deno@667a34cdef165d8d2b2e98dde39547c9daac7282 # v2
         with:
           deno-version: v2.x
           cache: true
       - name: Setup Deno (Windows - no cache)
         if: matrix.os == 'windows-latest'
-        uses: denoland/setup-deno@v2
+        uses: denoland/setup-deno@667a34cdef165d8d2b2e98dde39547c9daac7282 # v2
         with:
           deno-version: v2.x
           cache: false
       - name: Install dependencies
-        run: deno install
+        run: deno ci
       - name: Run Juniper tests with coverage (Ubuntu)
         if: matrix.os == 'ubuntu-latest'
         run: deno task test --coverage
@@ -58,7 +60,7 @@ jobs:
         run: deno coverage --detailed
       - name: Upload coverage (Ubuntu)
         if: matrix.os == 'ubuntu-latest'
-        uses: codecov/codecov-action@v5
+        uses: codecov/codecov-action@0fb7174895f61a3b6b78fc075e0cd60383518dac # v5
         with:
           fail_ci_if_error: true
           files: src/coverage/lcov.info
@@ -94,14 +96,14 @@ jobs:
           --health-retries 5
     steps:
       - name: Clone repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
       - name: Setup Deno
-        uses: denoland/setup-deno@v2
+        uses: denoland/setup-deno@667a34cdef165d8d2b2e98dde39547c9daac7282 # v2
         with:
           deno-version: v2.x
           cache: true
       - name: Install dependencies
-        run: deno install
+        run: deno ci
       - name: Apply migrations to the test database
         run: deno task --cwd=templates/postgres db:migrate:test
       - name: Run postgres template tests
@@ -118,21 +120,20 @@ jobs:
       pull-requests: write
     steps:
       - name: Clone repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
         with:
           fetch-depth: 0
           ssh-key: ${{ secrets.DEPLOY_KEY }}
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: 22
       - name: Setup Deno
-        uses: denoland/setup-deno@v2
+        uses: denoland/setup-deno@667a34cdef165d8d2b2e98dde39547c9daac7282 # v2
         with:
           deno-version: v2.x
-          cache: true
+          # No shared dependency cache on the publish job: it is the only job
+          # with id-token: write, so it must not restore a cache another job
+          # could have populated.
+          cache: false
       - name: Install dependencies
-        run: deno install
+        run: deno ci
       - name: Copy README, LICENSE, and docs to src
         run: |
           cp README.md src/
@@ -142,17 +143,12 @@ jobs:
       - name: Run semantic-release
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        # @sebbo2002/semantic-release-jsr@4.0.0 ships a CJS bundle that
-        # semantic-release rejects as an invalid plugin config (EPLUGINSCONF):
-        # https://github.com/sebbo2002/semantic-release-jsr/issues/153
-        # Fixed upstream on @next (4.0.1-develop); pin to the last good 3.x and
-        # un-pin to ^4.0.1 once it ships stable. The other tools track latest.
-        run: >-
-          npx
-          --package semantic-release
-          --package @semantic-release/changelog
-          --package @semantic-release/exec
-          --package @semantic-release/git
-          --package @semantic-release/github
-          --package @sebbo2002/semantic-release-jsr@3.2.1
-          semantic-release
+        # Run through Deno, not npx: semantic-release and its plugins resolve
+        # from deno.lock under minimumDependencyAge with npm lifecycle scripts
+        # disabled, so the only code executing while id-token: write is active is
+        # pinned and integrity-checked. Versions are pinned in deno.json:
+        # semantic-release is held at ^24 because v25's engines (>=24.10) reject
+        # Deno's emulated Node; @sebbo2002/semantic-release-jsr is held at 3.2.1
+        # because 4.0.0 ships a CJS bundle semantic-release rejects as
+        # EPLUGINSCONF (https://github.com/sebbo2002/semantic-release-jsr/issues/153).
+        run: deno run -A npm:semantic-release

.github/workflows/pr-title.yml

@@ -1,6 +1,10 @@
 name: PR Title
 
 on:
+  # pull_request_target runs in the base-repo context (needed to read fork PR
+  # titles), but this workflow checks out NO code, writes NO cache, and holds
+  # only pull-requests: read — so it can't be used to poison a cache or reach
+  # secrets. Keep it that way: never add actions/checkout or a build step here.
   pull_request_target:
     types:
       - opened
@@ -16,7 +20,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check PR title follows Conventional Commits
-        uses: amannn/action-semantic-pull-request@v5
+        uses: amannn/action-semantic-pull-request@e32d7e603df1aa1ba07e981f2a23455dee596825 # v5
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:

deno.json

@@ -1,4 +1,5 @@
 {
+  "minimumDependencyAge": "P3D",
   "workspace": [
     "./src",
     "./example",
@@ -181,9 +182,15 @@
     }
   },
   "imports": {
+    "@sebbo2002/semantic-release-jsr": "npm:@sebbo2002/semantic-release-jsr@3.2.1",
+    "@semantic-release/changelog": "npm:@semantic-release/changelog@^6.0.3",
+    "@semantic-release/exec": "npm:@semantic-release/exec@^7.1.0",
+    "@semantic-release/git": "npm:@semantic-release/git@^10.0.1",
+    "@semantic-release/github": "npm:@semantic-release/github@^12.0.8",
     "react": "npm:react@^19.2.7",
     "react-dom": "npm:react-dom@^19.2.7",
-    "@types/react": "npm:@types/react@^19.2.16"
+    "@types/react": "npm:@types/react@^19.2.16",
+    "semantic-release": "npm:semantic-release@^24.2.9"
   },
   "compilerOptions": {
     "lib": [