security: harden CI and dependency supply chain

.github/workflows/ci.yml

@@ -6,10 +6,8 @@ on:
   pull_request:
   workflow_dispatch:
 
-permissions:
-  contents: read
-  pages: write
-  id-token: write
+# Least privilege by default; jobs opt in to what they need.
+permissions: {}
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
@@ -18,27 +16,38 @@ concurrency:
 jobs:
   build:
     runs-on: ubuntu-latest
+    timeout-minutes: 15
+    permissions:
+      contents: read
     steps:
-      - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v4
-      - uses: actions/setup-node@v4
+      # Actions are pinned to full commit SHAs so a moved/compromised tag can't inject code.
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        with:
+          persist-credentials: false
+      - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v4.4.0
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: "22.x"
       - run: pnpm install --frozen-lockfile
+      - run: pnpm audit --prod --audit-level high
       - run: pnpm build
         env:
           VITE_BASE: /${{ github.event.repository.name }}/
-      - uses: actions/upload-pages-artifact@v3
+      - uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3.0.1
         with:
           path: ./dist
 
   deploy:
     if: github.ref == 'refs/heads/main' && github.event_name != 'pull_request'
     needs: build
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      pages: write
+      id-token: write
     environment:
       name: github-pages
       url: ${{ steps.deployment.outputs.page_url }}
-    runs-on: ubuntu-latest
     steps:
       - id: deployment
-        uses: actions/deploy-pages@v4
+        uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4.0.5

package.json

@@ -2,7 +2,7 @@
   "name": "adaptive-semantic-judgement-task",
   "type": "module",
   "version": "1.0.1",
-  "packageManager": "pnpm@10.10.0",
+  "packageManager": "pnpm@10.34.7",
   "description": "This task shows word pairs and uses speech synthesis to read them out. The participant then has to decide if the words are related or unrelated",
   "author": "Cian Monnin",
   "scripts": {
@@ -21,11 +21,24 @@
     "@types/node": "^20.17.8",
     "eslint": "^9.17.0",
     "typescript": "~5.5.4",
-    "vite": "^5.4.12"
+    "vite": "^6.4.4"
   },
   "pnpm": {
     "overrides": {
-      "marked": "15.0.3"
-    }
+      "marked": "15.0.3",
+      "brace-expansion@<2": "^1.1.21",
+      "brace-expansion@>=2 <3": "^2.0.2",
+      "brace-expansion@>=3": "^5.0.12",
+      "js-yaml@>=4": "^4.3.2",
+      "nanoid@<4": "^3.3.18",
+      "postcss": "^8.5.23",
+      "postcss-selector-parser@<7": "^6.1.5",
+      "postcss-selector-parser@>=7": "^7.1.6",
+      "source-map-js": "^1.2.2"
+    },
+    "ignoredBuiltDependencies": [
+      "docsify",
+      "esbuild"
+    ]
   }
 }