chore: harden dependency, analysis, and release governance

[ty-everett]

Summary

Implements phase one of #310: make dependency updates, CI analysis, and npm releases enforceable and reviewable before the remaining compatibility/security batches are merged.

Dependency and supply-chain controls

• moves pnpm 10 policy to pnpm-workspace.yaml
• explicitly allows or denies every discovered dependency lifecycle script
• delays ordinary new releases for 24 hours while exempting coordinated first-party @bsv/* publication
• rejects provenance downgrades in the recent supply-chain window
• raises vulnerable transitive ranges to patched versions
• adds a fail-closed high/critical pnpm audit gate
• removes broad root overrides that masked package-level compatibility
• declares the previously phantom ts-jest dependency in @bsv/simple

Audit delta: 3 critical / 24 high / 31 moderate / 12 low dependency instances before; 0 critical / 0 high / 8 moderate / 5 low after.

Dependabot and merge governance

• consolidates pnpm, infra npm lockfiles, and Actions into one monthly multi-ecosystem PR
• limits the stream to one open PR and keeps it automatically rebased
• leaves first-party @bsv/* synchronization to the release workflow
• adds dependency review and a deterministic merge-gate
• expands CODEOWNERS over dependency, analysis, and release controls

This directly addresses the review feedback on #284. That stale PR should be closed as superseded after this replacement lands.

Analysis and coverage

• classifies tests correctly for Sonar and collects LCOV from every changed package
• adds wallet-toolbox and VeriFast coverage paths
• raises Codecov patch coverage to 90% with no threshold drift
• stages a pinned SonarQube Cloud CI scan with quality-gate waiting
• fixes both unsafe release-workflow install findings reported on feat(wallet-toolbox): horizontally scale Storage with shared async sessions #283 by installing with --ignore-scripts and explicitly rebuilding only the audited build tool

The scanner is intentionally guarded by SONAR_CI_ENABLED. A Sonar organization admin must first disable Automatic Analysis because Sonar forbids running both methods concurrently. The existing organization SONAR_TOKEN is already available to this repository.

Release controls

• serializes npm releases
• requires the protected npm-production environment
• rejects manual releases outside main
• rejects release tags not reachable from origin/main
• enforces the security audit before build/publication

Validation

• pnpm install --frozen-lockfile
• pnpm audit:security — no high/critical findings
• full workspace production build — 35/37 packages (root and non-production example excluded)
• 6,650 conformance vectors
• SDK: 144 suites / 5,689 passing tests
• create-bsv-app: 34 suites / 235 passing tests
• @bsv/simple: 6 suites / 102 passing tests
• VeriFast: 5 suites / 49 tests plus real ESM, CJS, worker, browser-bundler, and WASM consumers
• remaining substantive workspace package suites passed serially; the generic recursive command ends only on the existing example-paymail placeholder test script that intentionally exits 1
• docs frontmatter and links: 89 files
• actionlint, YAML parsing, git diff --check
• check-sdk-peer.mjs (33 manifests) and check-versions.mjs

Rollout / rollback

After CI and independent approval, merge this PR, verify Dependabot accepts the grouped configuration, then install the additive required-check ruleset. Keep SONAR_CI_ENABLED=false until a Sonar admin disables Automatic Analysis and installs the new-code quality gate.

Rollback is one revert plus disabling the additive repository ruleset; no package is published by this PR.

Explicit exclusions

• PR fix(wallet-toolbox): derive ChainTracks from Arcade host, drop babbage defaults #306 remains untouched and excluded.
• BDK refactor(sdk): reduce cognitive complexity in Hash.ts (#44) #49 is out of scope.
• PRs feat(wallet-toolbox): plan noSend batches locally and commit atomically #289 and Make VeriFast production-ready and accelerate WASM verification #290 are already merged into the baseline.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​@​bsv/​sdk@​2.1.9
	npm/​ts-jest@​29.4.12
	npm/​webpack-dev-server@​5.2.6
	npm/​mysql2@​3.23.1

View full report

[socket-security]

All alerts resolved. Learn more about Socket for GitHub.

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

View full report

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud