Add pnpm supply-chain policy (recipe A)

[pyramation]

Summary

Rolls out the org-wide pnpm supply-chain policy to this repo, part of constructive-io/constructive-planning#1464.

• Adds pnpm-policy.yaml at the workspace root:
  • minimumReleaseAge: 2d — third-party releases wait two days before they can be installed. Most malicious releases are found and yanked well inside that window, so this catches supply-chain compromises without stalling normal upgrades.
  • blockExoticSubdeps: true (default kept) — no git/URL-sourced transitive dependencies were found in pnpm-lock.yaml, so nothing needed loosening here.
  • maintainers: [pyramation] and our owned scopes (@constructive-io, @constructive-db, @launchql, @pgpm, @pgpmjs, @pgsql) are exempt from the wait — we publish those ourselves, so waiting protects nothing.
  • intersect: true — the exemption list in pnpm-workspace.yaml only lists the first-party packages this lockfile actually resolves (6 scope globs + 5 named packages), not the full ~1100 we publish org-wide. Derived automatically, not hand-maintained.
  • allowBuilds: {} — no install-script approvals were needed (see deviation note below).
  • exceptions: [] — none needed.
• Adds pnpm-policy and @constructive-io/pnpm-policy (pinned exact at 0.2.1, per save-exact=true in .npmrc) as root devDependencies.
• Adds policy / policy:check scripts to the root package.json.
• pnpm run policy patches the managed block into pnpm-workspace.yaml (packages/comments untouched).
• Wires pnpm run policy:check into .github/workflows/ci.yml, in the build-parser job, immediately after the root pnpm install step.

Deviations from the standard recipe

• pnpm version: this repo pins packageManager: pnpm@8.15.0, which predates the allowBuilds key (needs pnpm >= 10.16). Both policy and policy:check scripts pass --builds-key onlyBuiltDependencies so the tool emits/checks the older key name. pnpm-workspace.yaml had no prior onlyBuiltDependencies entry, so there was nothing to carry over/delete.
• allowBuilds is empty: on pnpm 8.15.0, pnpm install ran all install scripts (@launchql/protobufjs postinstall, parser prepare) without any ERR_PNPM_IGNORED_BUILDS gate — that enforcement is a pnpm 9/10+ feature. So no packages needed an explicit approval entry. This repo builds via WASM (see LOADING_WASM.md), not node-gyp/native compilation, so there's no native-binding install step to approve either.
• CI hook location: chose the build-parser job (not matrixed, runs once per trigger) over the matrixed build-wasm/test jobs, to avoid running the check redundantly 6x per workflow run.

Verification

All three passed locally before opening this PR:

pnpm run policy:check          # "matches the policy"
pnpm install --frozen-lockfile # succeeded
pnpm run policy                # "Unchanged" — shasum of pnpm-workspace.yaml identical before/after

🤖 Generated with Claude Code

https://claude.ai/code/session_01CEswUi4ANuB58rva48aHge

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​constructive-io/​pnpm-policy@​0.2.1
	pnpm-policy@​0.2.2

View full report