Supply chain improvements (#209)

* chore: Apply supply chain improvements

Add the npm minimum release age policy, move CI and publish workflows to Node 26, pin third-party Actions to commit SHAs, switch npm publishing to OIDC provenance, and apply npm audit fixes.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Update .github/workflows/accessibility-alt-text-bot.yml

Co-authored-by: Clay Miller <clay@smockle.com>

* Update .github/workflows/ci.yml

* Update .github/workflows/publish.yml

* Update .github/workflows/ci.yml

* Update .github/workflows/publish.yml

---------

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Clay Miller <clay@smockle.com>

Author: 3 people

.github/workflows/accessibility-alt-text-bot.yml

@@ -23,4 +23,4 @@ jobs:
     if: ${{ github.event.issue || github.event.pull_request || github.event.discussion }}
     steps:
       - name: Get action 'github/accessibility-alt-text-bot'
-        uses: github/accessibility-alt-text-bot@v1.7.3
+        uses: github/accessibility-alt-text-bot@7e895d46677f15841def9acef1239ea7c12593a5 # v1.7.3

.github/workflows/ci.yml

@@ -11,9 +11,9 @@ jobs:
   lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-node@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
-          node-version: 22
+          node-version: 26
       - run: npm ci
       - run: npm test

.github/workflows/publish.yml

@@ -11,10 +11,10 @@ jobs:
   publish-npm:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-node@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
-          node-version: 22
+          node-version: 26
           registry-url: https://registry.npmjs.org/
           cache: npm
       - run: npm ci
@@ -24,6 +24,4 @@ jobs:
           npm version ${TAG_NAME} --git-tag-version=false
         env:
           TAG_NAME: ${{github.event.release.tag_name}}
-      - run: npm whoami; npm --ignore-scripts publish --provenance
-        env:
-          NODE_AUTH_TOKEN: ${{secrets.NPM_TOKEN}}
+      - run: npm --ignore-scripts publish --provenance

.npmrc

@@ -0,0 +1 @@
+min-release-age=3

.nvmrc

@@ -1 +1 @@
-18
+26