chore(ci): lockdown dependencies and publishing

.github/workflows/publish.yml

@@ -5,20 +5,28 @@ on:
     types:
       - published
 
+permissions:
+  id-token: write  # Required for OIDC / npmjs publish
+
 jobs:
   publish:
     name: Publish to npm
     if: ${{ github.repository_owner == 'accordproject' }}
     runs-on: ubuntu-latest
+    environment: production
 
     steps:
       - name: git checkout
         uses: actions/checkout@v2
 
-      - name: Use Node.js ${{ matrix.node-version }}
-        uses: actions/setup-node@v1
+      - name: Use Node.js 20.x
+        uses: actions/setup-node@v4
         with:
-          node-version: 16.x
+          node-version: '20'
+          registry-url: 'https://registry.npmjs.org'
+
+      # Ensure npm 11.5.1 or later for trusted publishing
+      - run: npm install -g npm@latest
 
       - run: npm ci
       - run: npm run build --if-present

.syncpackrc.json

@@ -0,0 +1,12 @@
+{
+  "$schema": "https://unpkg.com/syncpack@14/schema.json",
+  "semverGroups": [
+    {
+      "label": "Enforce pinned versions (no ^ or ~)",
+      "dependencies": ["**"],
+      "dependencyTypes": ["prod", "dev", "peer"],
+      "packages": ["**"],
+      "range": ""
+    }
+  ]
+}