chore(repo): supply-chain and CI/CD hardening [PLT-103649]

[CalinaCristian]

What

• Frozen lockfile everywhere — pnpm install --frozen-lockfile enforced in all CI jobs and all vercel.json installs. Extracted into a reusable install-node-deps composite action.
• 14-day package quarantine — minimumReleaseAge: 20160 in pnpm-workspace.yaml. Temporary exemptions go in minimumReleaseAgeExclude with a version annotation; a new weekly workflow (prune-release-age-exemptions) auto-PRs their removal once they age out.
• pnpm audit + npm audit signatures on lockfile-change PRs.
• dependency-review-action blocks high+ severity advisories on every PR.
• Secret scoping — GH_NPM_REGISTRY_TOKEN / NPM_AUTH_TOKEN moved from workflow-level env: to step-level only.
• persist-credentials: false on all checkouts that don't need to push.
• Fork PR guards on dev-publish, dev-cleanup, vercel-deploy, and registry-check jobs.
• permissions: {} deny-all default added at workflow level across all workflows; each job grants only the minimum it needs.
• Dependabot configured with weekly updates, grouped PRs, and 14-day cooldown aligned with the quarantine.
• CODEOWNERS extended to cover .github/, pnpm-workspace.yaml, pnpm-lock.yaml, scripts/, and apps/apollo-vertex/ (co-owned by both teams).
• pnpm.onlyBuiltDependencies allowlist restricts lifecycle scripts to esbuild, @biomejs/biome, and sharp (optional native dep of Next.js for image optimisation).
• zizmor + actionlint added to security scan workflow; all shellcheck issues fixed.
• harden-github-action Claude skill and .github/copilot-instructions.md added to keep these patterns consistent going forward.

[github-actions]

Dependency License Review

• ✅ 2093 package(s) scanned
• ✅ No license issues found
• ⚠️ 15 package(s) excluded (see details below)

License distribution

License	Packages
MIT	1819
ISC	104
Apache-2.0	64
BSD-3-Clause	30
BSD-2-Clause	24
Copyright 2022, UiPath, all rights reserved	9
BlueOak-1.0.0	8
MPL-2.0	5
MIT OR Apache-2.0	3
MIT-0	3
Unknown	3
Unlicense	3
CC0-1.0	3
LGPL-3.0-or-later	2
(MIT OR Apache-2.0)	2
Python-2.0	1
CC-BY-4.0	1
(MPL-2.0 OR Apache-2.0)	1
BSD	1
Artistic-2.0	1
(WTFPL OR MIT)	1
(BSD-2-Clause OR MIT OR Apache-2.0)	1
CC-BY-3.0	1
0BSD	1
(MIT OR CC0-1.0)	1
MIT AND ISC	1

Excluded packages

Package	Version	License	Reason
@img/sharp-libvips-linux-x64	1.2.4	LGPL-3.0-or-later	LGPL pre-built binary, not linked
@img/sharp-libvips-linuxmusl-x64	1.2.4	LGPL-3.0-or-later	LGPL pre-built binary, not linked
@uipath/apollo-angular-elements	5.89.0	Copyright 2022, UiPath, all rights reserved	UiPath first-party package
@uipath/apollo-core	4.35.1, 4.35.2	Copyright 2022, UiPath, all rights reserved	UiPath first-party package
@uipath/apollo-fonts	1.25.8	Copyright 2022, UiPath, all rights reserved	UiPath first-party package
@uipath/apollo-icons	1.33.7	Copyright 2022, UiPath, all rights reserved	UiPath first-party package
@uipath/apollo-mui5	2.31.26, 2.31.27	Copyright 2022, UiPath, all rights reserved	UiPath first-party package
@uipath/portal-shell	3.351.4	Copyright 2022, UiPath, all rights reserved	UiPath first-party package
@uipath/portal-shell-react	3.149.36	Copyright 2022, UiPath, all rights reserved	UiPath first-party package
@uipath/portal-shell-types	3.326.0	Copyright 2022, UiPath, all rights reserved	UiPath first-party package
@uipath/portal-shell-util	1.114.0	Copyright 2022, UiPath, all rights reserved	UiPath first-party package
@uipath/apollo-lab	25.12.0	Unknown	UiPath first-party package
@uipath/telemetry-client-web	5.1.0	Unknown	UiPath first-party package
khroma	2.1.0	Unknown	MIT per GitHub repo, missing license field in package.json
hyperx	2.5.4	BSD	BSD-2-Clause per LICENSE file, non-SPDX "BSD" in package.json

[Copilot]

Pull request overview

Enforces reproducible dependency installs for Apollo Vertex by freezing the lockfile during installs in both CI registry checks and Vercel deployments, reducing “works on my machine” drift and unexpected dependency resolutions.

Changes:

• Update Vercel install command to pnpm install --frozen-lockfile.
• Update the Apollo Vertex registry check workflow to install with --frozen-lockfile.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
apps/apollo-vertex/vercel.json	Enforces frozen-lockfile installs during Vercel builds for deterministic deploys.
.github/workflows/apollo-vertex-registry-check.yml	Enforces frozen-lockfile installs in CI to fail fast on lockfile drift.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated no new comments.

[bryan-uipath]

Thanks @CalinaCristian for the hardening here

[Copilot]

Pull request overview

Copilot reviewed 34 out of 36 changed files in this pull request and generated 3 comments.

Files not reviewed (1)

• pnpm-lock.yaml: Language not supported

Comments suppressed due to low confidence (1)

.github/workflows/apollo-vertex-registry-check.yml:154

• This step runs pnpm dlx tsx@4.20.6, but tsx is already pinned in root devDependencies. If possible, install deps in this job and use pnpm exec tsx ... so the executed binary is lockfile-controlled and covered by your audits; keep dlx only if you intentionally want an ephemeral install here.

        env:
          NODE_AUTH_TOKEN: ${{ secrets.GH_NPM_REGISTRY_TOKEN }}
          COMPONENTS: ${{ matrix.components }}
          BASE_APP_PATH: ${{ runner.temp }}/base-app
        run: pnpm dlx tsx@4.20.6 ${{ github.workspace }}/.github/scripts/test-registry/test-registry.ts

[Copilot]

Pull request overview

Copilot reviewed 34 out of 36 changed files in this pull request and generated 10 comments.

Files not reviewed (1)

• pnpm-lock.yaml: Language not supported

Comments suppressed due to low confidence (7)

.github/workflows/pr-checks.yml:18

• This workflow sets non-empty top-level permissions: (contents: read). The hardening guidance added in this PR requires permissions: {} at workflow level and per-job minimal grants. Consider switching to deny-all at the workflow level and moving required permissions to each job.

This issue also appears on line 36 of the same file.

env:
  BASE_REF: ${{ github.event.pull_request.base.ref }}

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

.github/workflows/pr-checks.yml:47

• Install Node dependencies passes secrets.GH_NPM_REGISTRY_TOKEN on a pull_request workflow without a fork guard. On fork PRs this secret will be unavailable and the job will likely fail during install. Add if: github.event.pull_request.head.repo.fork == false to jobs that require this secret, or make the composite action gracefully handle fork PRs (e.g., optional token + skip GitHub Packages auth when empty).

    steps:
      - name: Checkout code
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Install Node dependencies
        uses: ./.github/actions/install-node-deps
        with:
          registry-token: ${{ secrets.GH_NPM_REGISTRY_TOKEN }}

.github/workflows/commit-lint.yml:13

• This workflow lacks a workflow-level permissions: {} deny-all block (it only sets job permissions). If the repo standard is deny-all at the workflow level, add permissions: {} and keep contents: read only at the job level.

This issue also appears in the following locations of the same file:

• line 7
• line 25

name: Commit Lint

on:
  pull_request:
    types: [opened, edited, synchronize, reopened]

jobs:
  commitlint:
    name: Validate Commit Messages
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:

.github/workflows/commit-lint.yml:24

• This job runs on pull_request but installs dependencies using secrets.GH_NPM_REGISTRY_TOKEN without a fork guard. Fork PRs won’t have this secret and the workflow will likely fail. Add if: github.event.pull_request.head.repo.fork == false to the job or adjust install so it can run without secrets for forks.

jobs:
  commitlint:
    name: Validate Commit Messages
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - name: Checkout code
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Install Node dependencies
        uses: ./.github/actions/install-node-deps
        with:
          registry-token: ${{ secrets.GH_NPM_REGISTRY_TOKEN }}

.github/workflows/commit-lint.yml:30

• commitlint is a repo devDependency, but this step runs it via npx, which can introduce non-determinism and extra network behavior. Prefer pnpm exec commitlint ... to ensure the pinned workspace version is used.

      - name: Validate commit messages
        if: github.event_name == 'pull_request'
        env:
          BASE_SHA: ${{ github.event.pull_request.base.sha }}
          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
        run: npx commitlint --from "${BASE_SHA}" --to "${HEAD_SHA}" --verbose

.github/workflows/dev-cleanup.yml:23

• This workflow has no workflow-level permissions: {} deny-all block. If deny-all is the repo standard, add permissions: {} at the workflow level and keep the current job permissions as the minimal grants.

jobs:
  cleanup:
    name: Cleanup Dev Packages
    runs-on: ubuntu-latest
    # Skip fork PRs — cleanup uses publish-scoped tokens; fork PRs must not receive them.
    if: github.event.pull_request.head.repo.fork == false
    permissions:
      contents: read
      pull-requests: write
      issues: write

.github/workflows/vercel-deploy.yml:139

• This job sets up pnpm and caches the pnpm store, but the workflow never runs pnpm install (or any other command that would benefit from the store cache). Consider removing the pnpm setup/cache steps to reduce runtime, or add/justify the pnpm usage if it’s needed for the deploy flow.

      - name: Setup Node.js
        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
        with:
          node-version: '22'

      - name: Setup pnpm
        uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4

      - name: Get pnpm store directory
        id: pnpm-cache
        run: |
          echo "pnpm_cache_dir=$(pnpm store path)" >> "$GITHUB_OUTPUT"

      - name: Setup pnpm cache
        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
        with:
          path: ${{ steps.pnpm-cache.outputs.pnpm_cache_dir }}
          key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }}
          restore-keys: |
            ${{ runner.os }}-pnpm-store-

[Copilot]

Pull request overview

Copilot reviewed 37 out of 39 changed files in this pull request and generated 4 comments.

Files not reviewed (1)

• pnpm-lock.yaml: Language not supported

[Copilot]

Pull request overview

Copilot reviewed 37 out of 39 changed files in this pull request and generated 2 comments.

Files not reviewed (1)

• pnpm-lock.yaml: Language not supported