GhostBus v0.5.8 — hardening round 7: supply chain

Hardening round 7 — supply chain & release integrity.

Actions pinned to immutable SHAs. The publish and CI workflows used mutable @v4 tags; both actions are now pinned to the exact commits those tags resolve to (actions/checkout and actions/setup-node at v4.4.0), verified live against the API — if a tag is ever re-pointed, this pipeline doesn't move. One deliberate non-pin, commented in the workflow: npm install -g npm@latest stays, because Trusted Publishing requires npm ≥ 11.5.1. The workflow itself was already least-privilege (contents: read, id-token: write; dry-run by default on manual dispatch), and this release is its first run with a new gate (below).

The tarball is now gated. A new scripts/check-pack.mjs enforces an allowlist over npm pack: exactly the runtime (src/, docs/, examples/, README, PLAN, CHANGELOG, LICENSE — and SECURITY.md, now shipped so the policy travels with the code). Tests, deploy/, scripts/, .github/, runtime state, and stray tarballs are forbidden by name, proven both ways (green on the real tree; fails naming every smuggled path on a doctored one). It runs in the suite and as a publish-workflow step — a future stray file can't quietly ship to npm.

Provenance: present and verifiable. Registry metadata for recent versions carries SLSA provenance attestations (sigstore) plus registry signatures — the chain from this repo's release workflow to the npm artifact is signed end to end. SECURITY.md now documents how to verify (npm audit signatures).

Honest corrections: engines claimed Node ≥18 but nothing ever verified 18 — CI evidence covers 20/22/24, so the floor is now ≥20 (README fixed to match). .gitignore didn't cover the hosted server's default data dir — a state file could have been committed by accident; fixed. Zero dependencies continues to mean npm audit: 0 vulnerabilities, by construction.

Verified: 71 checks (was 70), serverless 12/12, both demos; CI matrix now Node 20/22/24.

---

Correction (2026-10-11): this release's npm publish was blocked by the new pack-manifest gate — its parser assumed npm ≤ 11's output shape and npm 12 changed it, so the publish run failed the suite step and this version never reached npm. The gate did its job; the parser was the bug. Fixed and superseded on npm by v0.5.10 (see its CHANGELOG entry). The work described below ships in 0.5.10.