Add pnpm supply-chain policy (recipe A)

.github/workflows/ci.yml

@@ -159,6 +159,9 @@ jobs:
       - name: Install Dependencies 🧶
         run: pnpm install
 
+      - name: Check supply-chain policy
+        run: pnpm run policy:check
+
       - name: Install Parser Dependencies 📦
         run: pnpm install
         working-directory: parser

package.json

@@ -4,6 +4,8 @@
   "description": "PostgreSQL query parser monorepo",
   "packageManager": "pnpm@8.15.0",
   "scripts": {
+    "policy": "pnpm-policy generate --builds-key onlyBuiltDependencies",
+    "policy:check": "pnpm-policy check --builds-key onlyBuiltDependencies",
     "build": "pnpm --filter libpg-query build",
     "test": "pnpm --filter libpg-query test",
     "clean": "pnpm --filter libpg-query clean",
@@ -32,10 +34,12 @@
     "publish:parser": "pnpm --filter @pgsql/parser publish"
   },
   "devDependencies": {
+    "@constructive-io/pnpm-policy": "0.2.1",
     "@types/node": "^20.0.0",
     "copyfiles": "^2.4.1",
     "glob": "11.0.3",
     "pg-proto-parser": "^1.28.2",
+    "pnpm-policy": "0.2.2",
     "rimraf": "^5.0.0",
     "ts-node": "^10.9.1",
     "typescript": "^5.3.3"

pnpm-policy.yaml

@@ -0,0 +1,39 @@
+# Supply-chain policy for this workspace. The pnpm settings it produces live in
+# pnpm-workspace.yaml under the `Managed by pnpm-policy` marker — edit this file,
+# then run `pnpm run policy`. `pnpm run policy:check` fails CI when they drift.
+
+# Third-party releases wait two days. A compromised release is normally reported
+# and yanked within hours, so the short wait catches it without stalling upgrades.
+minimumReleaseAge: 2d
+
+# Transitive dependencies must resolve from the registry, not from git or a URL.
+blockExoticSubdeps: true
+
+# The npm accounts WE publish under. Everything they publish skips the wait, so
+# this lists accounts we control — nobody else's.
+maintainers:
+  - pyramation
+
+# Scopes we own outright, emitted as `@scope/*` globs so they also cover packages
+# published there tomorrow.
+scopes:
+  - "@constructive-io"
+  - "@constructive-db"
+  - "@launchql"
+  - "@pgpm"
+  - "@pgpmjs"
+  - "@pgsql"
+
+# Resolved from the pinned data package rather than regenerated per repo.
+inventory: "@constructive-io/pnpm-policy/inventory.json"
+
+# Only emit the first-party names this lockfile actually resolves, instead of all
+# ~1100 we publish.
+intersect: true
+
+# Dependencies allowed to run install scripts. The value is the reason.
+allowBuilds: {}
+
+# Third-party escape hatches. A reason is required; `until` expires the waiver so
+# `check` makes you re-justify it instead of letting it live forever.
+exceptions: []

pnpm-workspace.yaml

@@ -1,10 +1,10 @@
 packages:
   - 'parser'
   - 'versions/18'
-  - 'versions/17' 
-  - 'versions/16' 
-  - 'versions/15' 
-  - 'versions/14' 
+  - 'versions/17'
+  - 'versions/16'
+  - 'versions/15'
+  - 'versions/14'
   - 'versions/13'
   - 'types/18'
   - 'types/17'
@@ -17,4 +17,28 @@ packages:
   - 'enums/16'
   - 'enums/15'
   - 'enums/14'
-  - 'enums/13' 
+  - 'enums/13'
+
+# Managed by pnpm-policy — run `pnpm-policy generate` after editing pnpm-policy.yaml.
+
+# A third-party release must be 2d old before it can be installed.
+# Most malicious releases are found and yanked well inside that window.
+minimumReleaseAge: 2880
+
+# Exempt from the wait: 6 scope glob(s), 5 first-party package(s).
+# First-party membership comes from what pyramation publishes on npm — waiting on your own release protects nothing.
+minimumReleaseAgeExclude:
+  - "@constructive-db/*"
+  - "@constructive-io/*"
+  - "@launchql/*"
+  - "@pgpm/*"
+  - "@pgpmjs/*"
+  - "@pgsql/*"
+  - nested-obj
+  - pg-proto-parser
+  - pnpm-policy
+  - strfy-js
+  - yamlize
+
+# Transitive dependencies must come from the registry, not from git or a URL.
+blockExoticSubdeps: true