chore(repo): supply-chain and CI/CD hardening [PLT-103649]

.gitattributes

@@ -0,0 +1,8 @@
+# Normalize line endings on commit; check out as LF.
+* text=auto eol=lf
+
+# Shell scripts must stay LF on Windows checkouts so they execute on Linux runners.
+*.sh text eol=lf
+
+# Lockfile is generated; mark as text but discourage diffs.
+pnpm-lock.yaml text eol=lf linguist-generated=true

.github/actions/install-node-deps/action.yml

@@ -0,0 +1,31 @@
+name: Install Node dependencies
+description: Sets up pnpm + Node and runs `pnpm install --frozen-lockfile` against the @uipath GHP registry.
+
+inputs:
+  node-version:
+    description: Node major version
+    required: false
+    default: "22"
+  registry-token:
+    description: GitHub PAT with read:packages for the @uipath GHP registry.
+    required: true
+
+runs:
+  using: composite
+  steps:
+    - name: Setup pnpm
+      uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
+
+    - name: Setup Node.js
+      uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+      with:
+        node-version: ${{ inputs.node-version }}
+        cache: pnpm
+        registry-url: "https://npm.pkg.github.com"
+        scope: "@uipath"
+
+    - name: Install dependencies
+      shell: bash
+      env:
+        NODE_AUTH_TOKEN: ${{ inputs.registry-token }}
+      run: pnpm install --frozen-lockfile