chore(sec): harden workflows and min release age

.github/workflows/ci-agw-client.yml

@@ -10,21 +10,21 @@ jobs:
     timeout-minutes: 20
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@v4
+        uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
         with:
           package_json_file: package.json
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: 24
           cache: pnpm
 
       - name: Setup Foundry
-        uses: foundry-rs/foundry-toolchain@v1
+        uses: foundry-rs/foundry-toolchain@c7450ba673e133f5ee30098b3b54f444d3a2ca2d # v1
 
       - name: Install dependencies
         run: pnpm install --frozen-lockfile

.github/workflows/ci-contracts.yml

@@ -10,10 +10,10 @@ jobs:
     timeout-minutes: 15
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
       - name: Setup Foundry
-        uses: foundry-rs/foundry-toolchain@v1
+        uses: foundry-rs/foundry-toolchain@c7450ba673e133f5ee30098b3b54f444d3a2ca2d # v1
 
       - name: Install Solidity dependencies
         working-directory: packages/contracts

.github/workflows/ci-release-surface.yml

@@ -11,6 +11,7 @@ jobs:
     env:
       TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
       TURBO_TEAM: ${{ secrets.TURBO_TEAM }}
+      TURBO_REMOTE_CACHE_READ_ONLY: ${{ github.event_name == 'pull_request' && 'true' || '' }}
     strategy:
       fail-fast: false
       matrix:
@@ -24,15 +25,15 @@ jobs:
           - "@abstract-foundation/agw-cli"
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@v4
+        uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
         with:
           package_json_file: package.json
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: 24
           cache: pnpm

.github/workflows/ci-verify.yml

@@ -15,19 +15,20 @@ jobs:
     env:
       TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
       TURBO_TEAM: ${{ secrets.TURBO_TEAM }}
+      TURBO_REMOTE_CACHE_READ_ONLY: ${{ github.event_name == 'pull_request' && 'true' || '' }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
         with:
           fetch-depth: 0
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@v4
+        uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
         with:
           package_json_file: package.json
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: 24
           cache: pnpm
@@ -42,8 +43,8 @@ jobs:
         run: |
           if [[ "${{ inputs.event_name }}" == "pull_request" ]]; then
             git fetch origin main --depth=1
-            pnpm turbo run build --filter=...[origin/main] --filter=!./packages/contracts --filter=!./examples/*
-            pnpm turbo run typecheck --filter=...[origin/main] --filter=!./packages/contracts
+            pnpm turbo run build --filter='...[origin/main]' --filter=!./packages/contracts --filter=!./examples/*
+            pnpm turbo run typecheck --filter='...[origin/main]' --filter=!./packages/contracts
           else
             pnpm turbo run build --filter=!./packages/contracts --filter=!./examples/*
             pnpm turbo run typecheck --filter=!./packages/contracts
@@ -53,7 +54,7 @@ jobs:
         run: |
           if [[ "${{ inputs.event_name }}" == "pull_request" ]]; then
             git fetch origin main --depth=1
-            pnpm turbo run test --filter=...[origin/main] --filter=!./packages/contracts --filter=!@abstract-foundation/agw-client
+            pnpm turbo run test --filter='...[origin/main]' --filter=!./packages/contracts --filter=!@abstract-foundation/agw-client
           else
             pnpm turbo run test --filter=!./packages/contracts --filter=!@abstract-foundation/agw-client
           fi

.github/workflows/gatekeeper.yml

@@ -25,11 +25,11 @@ jobs:
       publish-surface: ${{ steps.filter.outputs.publish-surface }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
       - name: Paths filter
         id: filter
-        uses: dorny/paths-filter@v3
+        uses: dorny/paths-filter@d1c1ffe0248fe513906c8e24db8ea791d46f8590 # v3
         with:
           filters: |
             js:
@@ -88,10 +88,10 @@ jobs:
       summary_markdown: ${{ steps.detect.outputs.summary_markdown }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: 24
 
@@ -106,17 +106,17 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
         with:
           fetch-depth: 0
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@v4
+        uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
         with:
           package_json_file: package.json
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: 24
           cache: pnpm

.github/workflows/publish.yml

@@ -24,17 +24,18 @@ jobs:
       NPM_CONFIG_PROVENANCE: "true"
       TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
       TURBO_TEAM: ${{ secrets.TURBO_TEAM }}
+      TURBO_REMOTE_CACHE_READ_ONLY: ${{ github.event_name == 'pull_request' && 'true' || '' }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@v4
+        uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
         with:
           package_json_file: package.json
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: 24
           cache: pnpm
@@ -46,7 +47,7 @@ jobs:
         run: pnpm turbo run build --filter='./packages/*' --filter='!./packages/contracts' --force
 
       - name: Publish packages
-        uses: changesets/action@v1
+        uses: changesets/action@63a615b9cd06ba9a3e6d13796c7fbcb080a60a0b # v1
         with:
           publish: pnpm changeset:publish
         env:

.github/workflows/release-pr.yml

@@ -20,24 +20,24 @@ jobs:
     steps:
       - name: Generate app token
         id: app-token
-        uses: actions/create-github-app-token@v1
+        uses: actions/create-github-app-token@d72941d797fd3113feb6b93fd0dec494b13a2547 # v1
         with:
           app-id: ${{ secrets.RELEASE_BOT_APP_ID }}
           private-key: ${{ secrets.RELEASE_BOT_PRIVATE_KEY }}
 
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
         with:
           fetch-depth: 0
           token: ${{ steps.app-token.outputs.token }}
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@v4
+        uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
         with:
           package_json_file: package.json
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: 24
           cache: pnpm
@@ -46,7 +46,7 @@ jobs:
         run: pnpm install --frozen-lockfile
 
       - name: Create or update release pull request
-        uses: changesets/action@v1
+        uses: changesets/action@63a615b9cd06ba9a3e6d13796c7fbcb080a60a0b # v1
         with:
           version: pnpm changeset:version
           commit: "chore: version packages"

pnpm-workspace.yaml

@@ -3,6 +3,10 @@ packages:
   - "examples/*"
   - "tools/*"
 
+minimumReleaseAge: 2880
+minimumReleaseAgeExclude:
+  - "@abstract-foundation/*"
+
 catalog:
   "@modelcontextprotocol/sdk": "^1.26.0"
   "@types/node": "^22.18.1"