chore(npm): add package-lock.json#103

Open

CoderDeltaLAN wants to merge 13 commits intomainfrom

fix/pinned-lockfile

Commits on Sep 22, 2025

ci: harden Scorecard — publish results and pin actions by SHA
CoderDeltaLAN
committed
ci: fix Scorecard SARIF uploader ref
CoderDeltaLAN
committed
ci: enforce least-privilege GITHUB_TOKEN (permissions: contents: read)
CoderDeltaLAN
committed
ci: enforce least-privilege at root (permissions: contents: read) and ignore _ci_diag for formatting
CoderDeltaLAN
committed
build(docker): pin base image by digest for reproducible builds
CoderDeltaLAN
committed
ci: pin all GitHub Actions to immutable SHAs
CoderDeltaLAN
committed
ci: fix malformed pinned action refs
CoderDeltaLAN
committed
ci: sign SBOM with Cosign (keyless) and attach sig+cert
CoderDeltaLAN
committed
ci: disable PyPI publishing until explicit approval
CoderDeltaLAN
committed
release: v0.1.8 — sync versions across PyPI/Release/Packages
CoderDeltaLAN
committed
ci: fix permissions for release workflows (attestations/id-token/contents)
CoderDeltaLAN
committed
ci: pause all release workflows (no auto-publish)
CoderDeltaLAN
committed
chore(npm): add package-lock.json for pinned dependencies
CoderDeltaLAN
committed