[mpsq]

Fixes the 7 open CodeQL alerts on main. Note that Dependabot updates SHA pins and keeps the version comment in sync.

• Swaps pnpm/action-setup + actions/setup-node + pnpm install for one pnpm/setup step, pinned to a commit SHA.
• Pins changesets/action to its commit SHA.
• Release keeps actions/setup-node, only for registry-url. changesets/action v2 doesn't set up npm auth, so publishing still needs the .npmrc it writes for NODE_AUTH_TOKEN.
• Sets permissions: contents: read on CI.
• Names every step and puts a blank line between steps.

actions/* and github/* stay on tags because CodeQL doesn't flag GitHub-owned actions.

---

Note

Low Risk
Workflow and Node version sourcing changes only; no application or publish logic changes beyond equivalent install/setup behavior.

Overview
Addresses CodeQL supply-chain alerts by pinning third-party actions (pnpm/setup, changesets/action) to commit SHAs while leaving actions/* and github/* on version tags.

CI, release, and schema-update workflows now use a single pnpm/setup step (replacing pnpm/action-setup, actions/setup-node for install, and a separate pnpm install) with node-version-file: .nvmrc, require-lockfile: true, and pnpm caching. A new .nvmrc pins Node 24. The release job still runs actions/setup-node only to set registry-url for npm publish auth via NODE_AUTH_TOKEN.

The CI workflow adds permissions: contents: read. All touched workflows give named steps and clearer spacing; CodeQL gets step names only (no action pin changes there).

^{Reviewed by Cursor Bugbot for commit 7998b37. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Stale Bugbot comment from a previous run.

[cursor]

pnpm/setup ignores Node version file

Medium Severity

pnpm/setup does not accept node-version-file, so the new .nvmrc is ignored and CI, release, and schema jobs no longer pin Node 24. The action only honors runtime or devEngines.runtime, neither of which is set, so these workflows stay on the runner default instead of the >=24 engines pin.

Additional Locations (2)

• .github/workflows/release.yml#L21-L27
• .github/workflows/update-schema.yml#L33-L39

 

^{Reviewed by Cursor Bugbot for commit 501d0dd. Configure here.}

[mpsq]

that's wrong: https://github.com/pnpm/setup#inputs

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

There are 2 total unresolved issues (including 1 from previous review).

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 7998b37. Configure here.}

[cursor]

Lockfile input is not valid

Low Severity

require-lockfile is not an input of pnpm/setup, so the runner ignores it. The previous explicit pnpm install --frozen-lockfile step was removed, and this flag does not ask the action to enforce a lockfile.

Additional Locations (2)

• .github/workflows/release.yml#L26-L27
• .github/workflows/update-schema.yml#L38-L39

 

^{Reviewed by Cursor Bugbot for commit 7998b37. Configure here.}