Supply chain improvements

[dgreif]

Summary

• Added project npm release-age policy in .npmrc.
• Updated CI and publish workflows to use Node 26.
• Pinned third-party GitHub Actions to full commit SHAs.
• Switched npm publish from token-based auth to OIDC provenance publishing.
• Applied npm audit fix updates to transitive lockfile entries.

Ecosystems detected

• npm package with package-lock.json.
• GitHub Actions workflows for CI, publishing, and accessibility alt text checks.

Recommendations applied

• npm ci is already used in CI and publish workflows.
• Existing .nvmrc updated to match the Node 26 workflow runtime.
• No Vitest or Playwright setup detected.

Not automatically applied

• npm trusted publishing may need to be verified or configured for this package in npm before release publishing succeeds.

Human review notes

• Review the OIDC publishing change to confirm the npm package has trusted publishing configured for this repository and workflow.

Validation

• npm install
• npm ci
• npm test
• npm audit --audit-level=low

[Copilot]

Pull request overview

This PR hardens the project’s supply-chain posture by tightening dependency and release workflows: it updates lockfile transitive dependencies, pins GitHub Actions by commit SHA, moves CI/publish to Node 26, and switches npm publishing toward OIDC-based provenance.

Changes:

• Add an npm “minimum release age” policy via .npmrc.
• Update CI/publish workflows to Node 26 and pin referenced Actions to full commit SHAs.
• Refresh transitive dependencies in package-lock.json (via npm audit fix).

Show a summary per file

File	Description
package-lock.json	Updates transitive dependency versions/integrity metadata.
.nvmrc	Aligns local dev Node version with CI/publish runtime.
.npmrc	Introduces an npm minimum release-age policy.
.github/workflows/publish.yml	Pins Actions, updates Node runtime, and removes token-based publish in favor of provenance/OIDC.
.github/workflows/ci.yml	Pins Actions and updates Node runtime for CI.
.github/workflows/accessibility-alt-text-bot.yml	Pins the third-party action to a full commit SHA.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 5/6 changed files
• Comments generated: 1