Add pnpm supply-chain policy (recipe A)

[pyramation]

What

Adds the org-wide pnpm supply-chain policy to this repo, per the recipe in constructive-io/constructive-planning#1464.

• pnpm-policy.yaml at the workspace root: the human-edited source of truth.
• pnpm-workspace.yaml gets a minimumReleaseAge: 2d gate on third-party packages (first-party scopes/packages we publish are exempted — see minimumReleaseAgeExclude, derived automatically from what this lockfile actually resolves), plus an allowBuilds map for the packages allowed to run install scripts.
• pnpm run policy (regenerate) and pnpm run policy:check (drift check, wired into CI) scripts added.
• @constructive-io/pnpm-policy pinned to an exact 0.2.1 (no caret); pnpm-policy added as the CLI devDependency.

Why 2 days

A compromised release is normally reported and yanked within hours, so a short wait catches it without meaningfully stalling upgrades.

allowBuilds set

This repo had no onlyBuiltDependencies entries to carry over (none existed before this change). pnpm install flagged 3 packages under ERR_PNPM_IGNORED_BUILDS, now explicitly approved with real reasons:

Package	Reason
@launchql/protobufjs	postinstall checks for the optional native encoding helpers (bytebuffer/long) protobufjs uses for perf and prints a warning when they're absent; no code generation or network access happens.
nx	postinstall (bin/post-install) downloads the platform-specific @nx/nx-<os>-<arch> native binary the task-graph engine requires to run at all.
unrs-resolver	postinstall selects/loads the prebuilt napi-rs native binding for the current platform; the resolver package has no pure-JS fallback.

blockExoticSubdeps

Left true (default). No git- or URL-sourced dependencies found in pnpm-lock.yaml.

CI

Wired into the existing Supabase tests job in .github/workflows/ci.yml, immediately after the pnpm install step:

      - name: Check supply-chain policy
        run: pnpm run policy:check

Deviation to flag

This repo's CI (.github/workflows/ci.yml and portability.yml) pins pnpm/action-setup@v2 with version: 9. The allowBuilds key in pnpm-workspace.yaml is native pnpm functionality introduced around pnpm 10.16 — pnpm 9 predates the "ignored build scripts" approval gate entirely. Locally (pnpm 11.11.0, no packageManager field pins this repo to an older version), only allowBuilds actually satisfies ERR_PNPM_IGNORED_BUILDS — the older onlyBuiltDependencies key was tried first per the pnpm-policy tool's --builds-key compat flag, but pnpm 11 ignored it and still blocked the three packages' scripts until allowBuilds was added. Since this repo has no packageManager pin, I generated with the default (allowBuilds) key, matching actual local behavior. Recommend the org separately consider bumping the CI pnpm version pin to something >=10.16 so CI's install behavior matches local/dev; left untouched here since it's outside this recipe's scope.

Verification

All three passed locally before opening this PR:

pnpm run policy:check          # "matches the policy"
pnpm install --frozen-lockfile # succeeds
pnpm run policy                # "Unchanged" — shasum of pnpm-workspace.yaml identical before/after

🤖 Generated with Claude Code

https://claude.ai/code/session_01CEswUi4ANuB58rva48aHge

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​constructive-io/​pnpm-policy@​0.2.1
	pnpm-policy@​0.2.2

View full report