hookified - chore: defense - gate npm stage publish on Aikido scan-release

[jaredwray]

Summary

Gate the existing stage-publish job on a passing Aikido scan-release (section 6).

Status update: DEFENSE_IN_DEPTH.md: Aikido release gate → (PR #194 pending); stage publish → PR #193

Changes

• Add aikido-gate running pinned @aikidosec/ci-api-client@1.0.17 via sfw npm install --global.
• Run aikido-api-client scan-release with --fail-on-sast-scan --fail-on-iac-scan --fail-on-secrets-scan.
• Make the existing build / stage-publish job needs: [aikido-gate].
• Move id-token: write onto the stage-publish job so the gate does not inherit OIDC.
• Leave pack + pnpm stage publish and the rest of the pipeline unchanged.

The job is fail-closed if AIKIDO_CLIENT_API_KEY is unset. Add that secret from Aikido's Continuous Integration settings (it grants no publish authority).

Verification

• Stage-publish job needs: [aikido-gate]
• Gate uses SHA-pinned Socket Firewall and package-manager-cache: false
• Aikido client pin is current (1.0.17)
• zizmor ignore is scoped to the pinned ad-hoc install

Reference: defense-in-depth-nodejs § 6

Please check if the PR fulfills these requirements

• Followed the Contributing and Code of Conduct guidelines.
• Tests for the changes have been added (for bug fixes/features) with 100% code coverage.

What kind of change does this PR introduce? (Bug fix, feature, docs update, ...)
ci / security

  

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (84a774d) to head (5e4faa6).

Additional details and impacted files

@@            Coverage Diff            @@
##              main      #194   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files            5         5           
  Lines          433       433           
  Branches       109       109           
=========================================
  Hits           433       433           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.