[SMAKSS]

Summary

• Pin checkout v7.0.1, pnpm/setup v3.0.0, and upload-artifact v7.0.2 by commit SHA.
• Set Node 26 through .nvmrc and pnpm 12.17.0 through packageManager.
• Use pnpm/setup for Node, pnpm, and lockfile-required installation.
• Explicitly deny esbuild's install script with allowBuilds: { esbuild: false }, preserving the prior install-script policy.
• Remove npm registry configuration that can conflict with trusted publishing and remove the redundant global npm upgrade; the Node 26 runtime provides a sufficiently recent npm.
• Run the existing test script and make pnpm audit findings fail CI.
• Update vulnerable Vite/Vitest dependencies and transitive packages; the final pnpm audit reports zero advisories.
• Preserve the existing master and develop release channels.

Validation

• pnpm 12.17.0 lockfile update passed supply-chain verification.
• pnpm audit --audit-level moderate reports no known vulnerabilities.
• Formatting and git diff --check passed.
• PR CI on cb91720 passed.

[Copilot]

🟡 Changes recommended

The audit gate fails on a vulnerable dependency, the release workflow may use the wrong npm version, and the pnpm upgrade leaves an incompatible workspace setting that blocks clean installs.

3 open issues

• Vulnerable dependency makes the audit gate fail · New
• Global npm install leaves release using the runner's npm · New
• Migrate the removed ignoredBuiltDependencies setting · New

1 file not reviewed

• pnpm-lock.yaml: Generated file

What changed in this PR

Modernizes CI and publishing for @smakss/react-scroll-direction while preserving the master and develop release channels.

Changes:

• Pins GitHub Actions by commit SHA and consolidates runtime setup and dependency installation through pnpm/setup.
• Selects Node 26 and pnpm 12.17.0, adding package-manager entries to the lockfile.
• Adds tests and a blocking security audit to CI, and removes registry configuration from publishing setup.

File	Description
pnpm-lock.yaml	Adds pinned pnpm binaries and package-manager metadata.
package.json	Declares pnpm 12.17.0 as the package manager.
.nvmrc	Changes the Node version to 26.
.github/​workflows/​npm-publish.yml	Consolidates setup and removes registry configuration while retaining release channels.
.github/​workflows/​ci.yml	Pins actions, consolidates setup, runs tests, and makes audit findings fail CI.

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

The blocking audit fails on vulnerable dependencies in the committed lockfile, and the release workflow may use an older npm that cannot support trusted publishing.

3 open issues

• Migrate the removed ignoredBuiltDependencies setting
• Global npm install leaves release using the runner's npm
• Vulnerable dependency makes the audit gate fail

1 file not reviewed

• pnpm-lock.yaml: Generated file

_{Review effort: Balanced}