fix(ci): repair the install path — build approval, dead soak, skipped hook, ReDoS override

[unional]

Four install-path defects on main, all of them silent.

1. pnpm install fails on an unapproved build script

pnpm 11 turns an unapproved dependency build script into a non-zero exit rather than a warning. @repobuddy/jest v5 pulls in @swc/core, which ships a native binary via postinstall, so every renovate PR that bumps it dies at Install Dependencies before a test runs:

[ERR_PNPM_IGNORED_BUILDS] Ignored build scripts: @swc/core@1.16.1

That is what has been blocking #235. Reproduced locally on that branch, and with "@swc/core": true added it goes from failing at install to 7 suites / 63 tests passing.

2. The 24h release soak never applied

.npmrc carried minimumreleaseage=1440 — not a key npm or pnpm reads. npm prints Unknown project config "minimumreleaseage" and pnpm config get minimumReleaseAge returns undefined, so no dependency was ever held back. pnpm reads the setting from pnpm-workspace.yaml; moved there, it resolves to 1440.

Worth knowing: the kebab-case .npmrc spelling does not work either — minimum-release-age=1440 in .npmrc still reads back undefined. pnpm-workspace.yaml is the only location that takes effect.

3. .husky/commit-msg was not executable

Committed 100644, so git skipped it (hook was ignored because it's not set as executable) and commitlint has not run on any local commit. Now 100755, and it runs.

4. minimatch ReDoS — the repo's one open Dependabot alert (high)

minimatch >=9.0.0 <9.0.7, ReDoS in matchOne() via multiple non-adjacent GLOBSTAR segments. Nothing depends on minimatch 9 directly — the direct dependency is ^8. The vulnerable 9.0.3 is pinned by @typescript-eslint/parser@6.21.0, arriving through eslint-plugin-harmony, so no direct-dependency bump can move it. Scoped override on the 9 line only, leaving 3/5/7/8/10 alone; resolves to 9.0.9.

Verification

• pnpm install --frozen-lockfile and pnpm verify pass on this branch.
• Same change applied to chore(deps): update dependency @repobuddy/jest to v5 - autoclosed #235's branch: install succeeds, all 7 suites pass.

No runtime change to @unional/fixture, so no changeset. The other cause of fixture's red dependency PRs is separate and handled in #248.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 1a293b2

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 97.19%. Comparing base (c158777) to head (1a293b2).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #247   +/-   ##
=======================================
  Coverage   97.19%   97.19%           
=======================================
  Files           9        9           
  Lines         321      321           
  Branches       87       83    -4     
=======================================
  Hits          312      312           
  Misses          9        9           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.