install-time security hardening + toolchain pinning

.github/workflows/build-docs.yml

@@ -12,18 +12,19 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
       - name: Setup Pages
         uses: actions/configure-pages@v5
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v6
         with:
           node-version: "24.x"
           cache: npm
+      - run: npm install -g npm@11 --registry=https://registry.npmjs.org
       - run: npm ci
       - name: Build docs
         run: npm run docs -w @microbit/microbit-connection
       - name: Upload artifact
-        uses: actions/upload-pages-artifact@v3
+        uses: actions/upload-pages-artifact@v5
         with:
           path: ./packages/microbit-connection/docs/build
 
@@ -40,4 +41,4 @@ jobs:
     steps:
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@v4
+        uses: actions/deploy-pages@v5

.github/workflows/build.yml

@@ -12,12 +12,13 @@ jobs:
       contents: read
       packages: write
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v6
         with:
           node-version: "24.x"
           registry-url: "https://registry.npmjs.org"
           cache: npm
+      - run: npm install -g npm@11 --registry=https://registry.npmjs.org
       - run: npm ci
         env:
           NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -26,7 +27,7 @@ jobs:
         with:
           working-directory: packages/microbit-connection
       - run: npm run ci
-      - run: npm publish -w @microbit/microbit-connection
+      - run: npm publish -w @microbit/microbit-connection --allow-directory=all
         if: github.event_name == 'release' && github.event.action == 'created'
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

.node-version

@@ -0,0 +1 @@
+24.18.0

.npmrc

@@ -1 +1,15 @@
 access=public
+
+min-release-age=7
+min-release-age-exclude[]=@microbit/*
+min-release-age-exclude[]=@microbit-foundation/*
+
+# root here means this project's package.json
+allow-git=root
+allow-remote=root
+allow-file=root
+allow-directory=root
+
+strict-allow-scripts=true
+
+engine-strict=true

package.json

@@ -5,6 +5,15 @@
     "packages/*",
     "apps/*"
   ],
+  "allowScripts": {
+    "esbuild": true,
+    "fsevents": true
+  },
+  "packageManager": "npm@11.18.0",
+  "engines": {
+    "node": ">=24.0.0",
+    "npm": ">=11.18.0"
+  },
   "scripts": {
     "build": "npm run build:lib && npm run build -w @microbit/microbit-connection-demo",
     "build:lib": "npm run build -w @microbit/microbit-connection",