Fix supply-chain policy findings

.devcontainer/devcontainer.json

@@ -3,7 +3,7 @@
 {
   "name": "@bcc-code/component-library-vue",
   // Or use a Dockerfile or Docker Compose file. More info: https://containers.dev/guide/dockerfile
-  "image": "mcr.microsoft.com/devcontainers/typescript-node:4-22-trixie",
+  "image": "mcr.microsoft.com/devcontainers/typescript-node:4-24-trixie",
   "features": {
     "ghcr.io/devcontainers/features/node:2.0.0": {
       "pnpmVersion": "11.23.0"

.github/workflows/build-and-deploy-documentation.yml

@@ -26,7 +26,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Build documentation site
-        uses: bcc-code/bcc-developer-docs-deploy@v1
+        uses: bcc-code/bcc-developer-docs-deploy@7752f7e1f28cd0434ed5a18d936385187922e576 # v1
         with:
           title: BCC Design System
           description: Technical documentation and guides to facilitate the correct use of design assets of BCC

.github/workflows/deploy-assets.yml

@@ -24,11 +24,11 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
       - name: Build And Deploy
         id: builddeploy
-        uses: Azure/static-web-apps-deploy@v1
+        uses: Azure/static-web-apps-deploy@1a947af9992250f3bc2e68ad0754c0b0c11566c9 # v1
         with:
           azure_static_web_apps_api_token: ${{ secrets.AZURE_DESIGN_WEBSITE_DEPLOY_TOKEN }}
           repo_token: ${{ secrets.GITHUB_TOKEN }} # Used for Github integrations (i.e. PR comments)
@@ -43,7 +43,7 @@ jobs:
     steps:
       - name: Close Pull Request
         id: closepullrequest
-        uses: Azure/static-web-apps-deploy@v1
+        uses: Azure/static-web-apps-deploy@1a947af9992250f3bc2e68ad0754c0b0c11566c9 # v1
         with:
           azure_static_web_apps_api_token: ${{ secrets.AZURE_DESIGN_WEBSITE_DEPLOY_TOKEN }}
           action: "close"

.github/workflows/design-library-create-version.yml

@@ -40,14 +40,14 @@ jobs:
           token: ${{ secrets.BCC_BOT_ACCESS_TOKEN }}
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@v5
+        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
         with:
           version: 11.23.0
 
       - name: Setup Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
         with:
-          node-version: "22"
+          node-version: "24"
           registry-url: "https://registry.npmjs.org"
           cache: "pnpm"
           cache-dependency-path: component-library/pnpm-lock.yaml

.github/workflows/design-library-deploy-storybook-dev.yml

@@ -12,6 +12,9 @@ concurrency:
   group: storybook-dev-deploy
   cancel-in-progress: true
 
+env:
+  CI: true
+
 jobs:
   build-and-deploy:
     name: "Build and deploy Storybook"
@@ -29,24 +32,24 @@ jobs:
       contents: read
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@v6
+        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
         with:
           version: 11.23.0
 
       - name: Use Node.js
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
-          node-version: 22.22
+          node-version: "24"
           cache-dependency-path: "component-library/pnpm-lock.yaml"
           cache: "pnpm"
       - run: pnpm install --frozen-lockfile
       - run: pnpm run build-storybook
 
       - id: "auth"
-        uses: "google-github-actions/auth@v3"
+        uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0
         with:
           workload_identity_provider: ${{ vars.GCP_WIDPP_ID_DEV }}
           service_account: sa-gha-cicd@${{vars.GCP_PROJECT_ID}}.iam.gserviceaccount.com
@@ -70,6 +73,5 @@ jobs:
           }
           EOF
 
-      - run: pnpm add -g firebase-tools
       - name: Deploy hosting site
-        run: firebase deploy --only hosting --project "${{ vars.GCP_PROJECT_ID }}"
+        run: pnpm run deploy:hosting --project "${{ vars.GCP_PROJECT_ID }}"

.github/workflows/design-library-deploy-storybook-production.yml

@@ -9,6 +9,9 @@ concurrency:
   group: storybook-prod-deploy
   cancel-in-progress: true
 
+env:
+  CI: true
+
 jobs:
   build-and-deploy:
     name: "Build and deploy Storybook"
@@ -26,24 +29,24 @@ jobs:
       contents: read
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@v6
+        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
         with:
           version: 11.23.0
 
       - name: Use Node.js
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
-          node-version: 22.22
+          node-version: "24"
           cache-dependency-path: "component-library/pnpm-lock.yaml"
           cache: "pnpm"
       - run: pnpm install --frozen-lockfile
       - run: pnpm run build-storybook
 
       - id: "auth"
-        uses: "google-github-actions/auth@v3"
+        uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0
         with:
           workload_identity_provider: ${{ vars.GCP_WIDPP_ID_PROD }}
           service_account: sa-gha-cicd@${{vars.GCP_PROJECT_ID}}.iam.gserviceaccount.com
@@ -67,6 +70,5 @@ jobs:
           }
           EOF
 
-      - run: pnpm add -g firebase-tools
       - name: Deploy hosting site
-        run: firebase deploy --only hosting --project "${{ vars.GCP_PROJECT_ID }}"
+        run: pnpm run deploy:hosting --project "${{ vars.GCP_PROJECT_ID }}"

.github/workflows/design-library-prepare-release.yml

@@ -17,7 +17,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
       - run: git fetch --tags -f
 
@@ -40,7 +40,7 @@ jobs:
           } >> $GITHUB_OUTPUT
 
       - name: Create Release
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2.6.2
         with:
           draft: false
           name: "component-library ${{ steps.vars.outputs.TAG_NAME }}"

.github/workflows/design-library-release-dev.yml

@@ -24,25 +24,21 @@ jobs:
         working-directory: component-library
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@v5
+        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
         with:
           version: 11.23.0
 
       - name: Setup Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
         with:
-          node-version: "22"
+          node-version: "24"
           registry-url: "https://registry.npmjs.org"
           cache: "pnpm"
           cache-dependency-path: component-library/pnpm-lock.yaml
 
-      - run: |
-          npm install -g npm@~11.10.0
-          npm install -g npm@11 # Required for trusted publishing (npm 11.5.1 or later)
-
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
 
@@ -51,7 +47,7 @@ jobs:
         run: echo "sha_short=$(git rev-parse --short HEAD)" >> $GITHUB_OUTPUT
 
       - name: Restore cached build outputs
-        uses: actions/cache/restore@v5
+        uses: actions/cache/restore@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
         with:
           fail-on-cache-miss: true
           path: |
@@ -62,5 +58,6 @@ jobs:
 
       - name: Publish `@bcc-code/component-library-vue`
         run: |
-          npm version 0.0.0-dev.${{ steps.vars.outputs.sha_short }} --force --no-git-tag-version
-          npm publish --tag dev
+          pnpm version 0.0.0-dev.${{ steps.vars.outputs.sha_short }} --no-git-tag-version --no-git-checks
+          pnpm pkg delete engines # pnpm-only engines guard this repo, not consumers
+          pnpm publish --tag dev --no-git-checks

.github/workflows/design-library-release.yml

@@ -24,15 +24,15 @@ jobs:
         working-directory: component-library
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@v5
+        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
         with:
           version: 11.23.0
 
       - name: Setup Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
         with:
           node-version: "24"
           registry-url: "https://registry.npmjs.org"
@@ -50,7 +50,9 @@ jobs:
           echo "RELEASE_CHANNEL=$(pnpm --silent run release-channel)" >> $GITHUB_ENV
 
       - name: Publish `@bcc-code/component-library-vue`
-        run: npm publish --tag ${{ env.RELEASE_CHANNEL }}
+        run: |
+          pnpm pkg delete engines # pnpm-only engines guard this repo, not consumers
+          pnpm publish --tag ${{ env.RELEASE_CHANNEL }} --no-git-checks
 
       - name: Resolve release metadata from tag
         id: release_vars
@@ -66,7 +68,7 @@ jobs:
         working-directory: .
 
       - name: Create GitHub release
-        uses: softprops/action-gh-release@v3
+        uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3
         with:
           token: ${{ secrets.BCC_BOT_ACCESS_TOKEN }}
           draft: false

.github/workflows/design-library-tests.yml

@@ -19,17 +19,17 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@v5
+        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
         with:
           version: 11.23.0
 
       - name: Setup Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
         with:
-          node-version: "22"
+          node-version: "24"
           registry-url: "https://registry.npmjs.org"
           cache: "pnpm"
           cache-dependency-path: component-library/pnpm-lock.yaml
@@ -47,17 +47,17 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@v5
+        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
         with:
           version: 11.23.0
 
       - name: Setup Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
         with:
-          node-version: "22"
+          node-version: "24"
           registry-url: "https://registry.npmjs.org"
           cache: "pnpm"
           cache-dependency-path: component-library/pnpm-lock.yaml
@@ -79,17 +79,17 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@v5
+        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
         with:
           version: 11.23.0
 
       - name: Setup Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
         with:
-          node-version: "22"
+          node-version: "24"
           registry-url: "https://registry.npmjs.org"
           cache: "pnpm"
           cache-dependency-path: component-library/pnpm-lock.yaml
@@ -112,7 +112,7 @@ jobs:
         run: echo "sha_short=$(git rev-parse --short HEAD)" >> $GITHUB_ENV
 
       - name: Cache build outputs
-        uses: actions/cache/save@v5
+        uses: actions/cache/save@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
         with:
           path: |
             component-library/dist

.github/workflows/icons-create-version.yml

@@ -31,12 +31,17 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           token: ${{ secrets.BCC_BOT_ACCESS_TOKEN }}
 
+      - name: Setup pnpm
+        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
+        with:
+          version: 11.23.0
+
       - name: Setup Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
         with:
           node-version-file: icons/.node-version
           registry-url: "https://registry.npmjs.org"
@@ -47,7 +52,7 @@ jobs:
           git config --global user.email "84040471+bcc-bot@users.noreply.github.com"
 
       - name: Version new ${{ github.event.inputs.version }} version
-        run: npm run create-version ${{ github.event.inputs.version }} ${{ github.event.inputs.channel }}
+        run: pnpm run create-version ${{ github.event.inputs.version }} ${{ github.event.inputs.channel }}
         working-directory: icons
 
       - name: Push

.github/workflows/icons-prepare-release.yml

@@ -20,7 +20,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
       - run: git fetch --tags -f
 
@@ -30,7 +30,7 @@ jobs:
           echo "TAG_NAME=$(git describe --tags --abbrev=0)" >> $GITHUB_ENV
 
       - name: Create Release
-        uses: softprops/action-gh-release@v1
+        uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2.6.2
         with:
           draft: true
           name: "${{ env.TAG_NAME }}"