chore: tighten security even more- workflows, pinning, GH settings, etc

.github/workflows/ci.yml

@@ -35,8 +35,6 @@ jobs:
 
     - name: Security Audit
       run: npm audit --omit=dev --audit-level=moderate
-      # TODO: re-evaluate continue-on-error on Dec 18, 2025 or after js-yaml update
-      continue-on-error: true
 
     - name: Install Dependencies
       run: npm ci --prefer-offline

.github/workflows/linter.yml

@@ -8,6 +8,10 @@ on:
     branches: [main]
   workflow_dispatch:
 
+permissions:
+  contents: read
+  statuses: write
+
 # Prevent concurrent runs for the same PR/branch
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}

.github/workflows/release.yml

@@ -18,9 +18,6 @@ name: "Release"
           - 'true'
           - 'false'
 
-permissions:
-  contents: write
-
 # Prevent concurrent releases
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
@@ -30,6 +27,8 @@ jobs:
   release:
     runs-on: ubuntu-latest
     timeout-minutes: 15
+    permissions:
+      contents: write
 
     steps:
       - uses: actions/checkout@v6
@@ -43,8 +42,6 @@ jobs:
 
       - name: Security Audit
         run: npm audit --audit-level=moderate
-        # TODO: re-evaluate continue-on-error on Dec 18, 2025 or after js-yaml update
-        continue-on-error: true
 
       - name: Install Dependencies and Build
         run: |
@@ -170,13 +167,13 @@ jobs:
           retention-days: 90
 
   deploy-gh-pages:
+    permissions:
+      contents: write
     runs-on: ubuntu-latest
     needs: release
     timeout-minutes: 8
     # Only deploy gh-pages on actual releases, not dry-runs
     if: github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && inputs.dry_run == 'false')
-    permissions:
-      contents: write
 
     steps:
       - name: Checkout Tag

SECURITY.md

@@ -137,7 +137,7 @@ attacks:
   - Require branches to be up to date before merging: ✓
   - Required status checks:
     - `Analyze (javascript)` - CodeQL security analysis
-    - `Build Summary` - Build and test completion across Node.js versions
+    - `build` - Build and test completion across Node.js versions
     - `Lint Code Base` - Code quality and style checks
 
 - **Require signed commits**
@@ -153,17 +153,12 @@ attacks:
   - Only repository administrators can push directly
 
 - **Rules applied to administrators**
-  - Include administrators: ✓
-  - Even admins must follow branch protection rules
+  - Admins can push commits to pull request branches (bypass mode: pull_request)
+  - Admins still require passing status checks and reviews to merge
 
 - **Allow force pushes**: ✗ (disabled)
 - **Allow deletions**: ✗ (disabled)
 
-#### Additional Protections
-
-- **Lock branch**: Consider enabling for release branches
-- **Do not allow bypassing the above settings**: ✓
-
 ### Repository Settings
 
 Additional security settings enabled:

package.json

@@ -9,15 +9,15 @@
   },
   "description": "Project that makes Safari bookmarklets to automagically jump to the corresponding app and more.",
   "devDependencies": {
-    "@eslint/js": "^9.39.2",
-    "@types/node": "~25.0.10",
-    "@typescript-eslint/eslint-plugin": "^8.53.1",
-    "@typescript-eslint/parser": "^8.53.1",
-    "eslint": "^9.39.2",
-    "eslint-plugin-security": "^3.0.1",
-    "globals": "~17.0.0",
-    "terser": "~5.46.0",
-    "typescript": "~5.9.3"
+    "@eslint/js": "9.39.2",
+    "@types/node": "25.0.10",
+    "@typescript-eslint/eslint-plugin": "8.53.1",
+    "@typescript-eslint/parser": "8.53.1",
+    "eslint": "9.39.2",
+    "eslint-plugin-security": "3.0.1",
+    "globals": "17.1.0",
+    "terser": "5.46.0",
+    "typescript": "5.9.3"
   },
   "engines": {
     "node": ">=24.13.0",

preflight

@@ -109,4 +109,16 @@ fi
 echo '    scripts/*.js, src/*.ts, .github/linters/*.js: TypeScript & JavaScript OK'
 echo
 
+## check for @eslint/mcp updates (pinned in .mcp.json)
+if [ -f .mcp.json ]; then
+  MCP_CURRENT=$(sed -n 's/.*@eslint\/mcp@\([0-9][0-9.]*\).*/\1/p' .mcp.json)
+  if [ -n "$MCP_CURRENT" ]; then
+    MCP_LATEST=$(npm view @eslint/mcp version 2>/dev/null)
+    if [ -n "$MCP_LATEST" ] && [ "$MCP_CURRENT" != "$MCP_LATEST" ]; then
+      echo "  NOTE: @eslint/mcp $MCP_LATEST available (pinned: $MCP_CURRENT) - update .mcp.json"
+    fi
+  fi
+fi
+echo
+
 echo '  OK, preflight checks passed.'