Layer 8: supply chain CI (provenance, lockfile guard, install-scripts check, SBOM, signed binary)

[cdrn]

The trust story. Without this, nothing else matters.

Scope

• GitHub Actions workflow:
  • Pinned action versions (SHA, not tag)
  • OIDC publish to npm (no NPM_TOKEN)
  • npm publish --provenance for attestations
  • Job that fails CI if any dep in the resolved tree declares postinstall / preinstall / prepare
  • Lockfile diff guard: PR fails if package-lock.json changes without a CHANGES.md entry mentioning the change
  • .npmrc ships with ignore-scripts=true enabled
• SBOM (CycloneDX) generated on release, attached as a release asset.
• Standalone binary build via Node's single-executable application (SEA), one per supported platform; signed (codesign on macOS, sigstore cosign elsewhere); attached as release assets with checksums.
• "Verifying a release" section in README with the exact commands to verify provenance, SBOM, and binary signatures.

Acceptance criteria

• A release on GitHub produces: signed npm publish with provenance attestation, SBOM, signed binaries, checksums file.
• Install-scripts check correctly fails on a fixture PR that adds a dep with a postinstall script.
• Provenance attestation is verifiable from a fresh clone with documented commands.

Deps

Touches everything; do last.

[cdrn]

Partial down-payment landed in bb500bc (merged via PR #10).

What's now in place:

• GitHub Actions workflow runs `npm ci` + `npm test` on push to `main` and on PRs
• Actions pinned by SHA (not tag): `actions/checkout@34e1148` and `actions/setup-node@49933ea`
• Least-privilege workflow permissions (`contents: read`)
• Concurrency cancels duplicate runs
• Branch protection on `main` requires the `Test (Node 22)` check + linear history; force-pushes and deletions blocked

Still to do under this issue:

• Install-scripts CI guard (fails build if any resolved dep declares `postinstall` / `preinstall` / `prepare`)
• Lockfile diff guard
• OIDC publish to npm with `--provenance`
• SBOM (CycloneDX) generated on release
• Signed standalone binary builds via Node SEA
• "Verifying a release" section in README with the exact commands
• Action SHA rotation (Dependabot, watching for the Node 20→24 Actions runner cutover June 2 2026)