XS⚠️ ◾ Repo Enhancements

[muiriswoulfe]

Summary

This changes the project's configuration files and build scripts. The most significant changes include the addition of hardening steps to the GitHub Actions workflows, updates to Node.js and npm commands, and modifications to file paths and URLs.

GitHub Actions Workflow Updates:

• Harden Runner steps have been added to all jobs in the .github/workflows/build.yml, .github/workflows/release-phase-1-internal.yml, .github/workflows/release-phase-2.yml, and .github/workflows/support/release-phase-1-comment.md files. These steps use the step-security/harden-runner action to improve the security of the runner environment. [1] [2] [3] [4] [5] [6] [7] [8] [9] [10] [11] [12]

Node.js and npm Command Updates:

• The Node.js version used in the workflows has been downgraded from 22.x to LTS 20.14.0. [1] [2] [3] [4] [5] [6] [7] [8] [9] [10]
• The npm install commands have been replaced with npm ci for more reliable dependency installations. [1] [2] [3] [4] [5] [6] [7] [8] [9] [10] [11]
• The npm-check-updates package has been added to the project's dependencies.

File Path and URL Modifications:

• The indent_size setting for the LICENSE.txt file has been moved to the src/LICENSE.txt file in the .editorconfig file.
• Several URLs in the README.md and docs/development.md files have been updated to their correct versions. [1] [2]
• The LICENSE.txt reference in the README.md file has been updated to LICENSE so that it will be picked up by GitHub.
• The npm install -g tfx-cli step has been removed from the .github/workflows/build.yml and .github/workflows/release-phase-2.yml files. The tfx-cli command is now run with npx. [1] [2]
• The npm install -g npm-check-updates step has been removed from the .github/workflows/release-phase-1-internal.yml file. The ncu -u command is now run with npx.
• The npm install && mkdirp $npm_config_dir && ncp src $npm_config_dir command in the build:initialization script in the package.json file has been updated to use npm ci instead of npm install.
• The URL for the reflect-metadata library in the src/LICENSE.txt file has been added.

[github-actions]

PR Metrics

✔ Thanks for keeping your pull request small.
⚠️ Consider adding additional tests.

	Lines
Product Code	5
Test Code	-
Subtotal	5
Ignored Code	3,129
Total	3,134

Metrics computed by PR Metrics. Add it to your Azure DevOps and GitHub PRs!