Improve npm package installation security (#57)

* Improve npm package installations security

* Add @types/node as a dev dep

Author: microbit-grace

.github/workflows/build-docs.yml

@@ -12,9 +12,15 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
+      - uses: actions/setup-node@v6
+        with:
+          node-version: '24.x'
+          registry-url: 'https://registry.npmjs.org'
+          cache: npm
       - name: Setup Pages
         uses: actions/configure-pages@v5
+      - run: npm install -g npm@11 --registry=https://registry.npmjs.org
       - run: npm ci
       - name: Build docs
         run: npm run docs

.github/workflows/build.yml

@@ -11,15 +11,16 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v6
         with:
-          node-version: '20.x'
+          node-version: '24.x'
           registry-url: 'https://registry.npmjs.org'
           cache: npm
+      - run: npm install -g npm@11 --registry=https://registry.npmjs.org
       - run: npm ci
       - run: npm run ci
-      - run: npm publish
+      - run: npm publish --allow-directory=all
         if: github.event_name == 'release' && github.event.action == 'created'
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

.npmrc

@@ -1,2 +1,16 @@
 access=public
 save-exact=true
+
+min-release-age=7
+min-release-age-exclude[]=@microbit/*
+min-release-age-exclude[]=@microbit-foundation/*
+
+# root here means this project's package.json
+allow-git=root
+allow-remote=root
+allow-file=root
+allow-directory=root
+
+strict-allow-scripts=true
+
+engine-strict=true