ci: enforce wix gateway proxy, with npm cooldown + OIDC in publish

[guyofeck]

What

Supersedes #247 — it carries Dor's gateway commit unchanged (0142b34) plus one follow-up commit that ports base44/cli#597 (596104f) to this repo. Landing them together avoids merging a state whose publish workflows still rely on the sed -i /etc/hosts unpin hack.

Commit 1 — ci: enforce wix gateway proxy in all workflows (Dor, unchanged): routes every npm-registry fetch through the Wix npm embargo gateway, plus check_wix_proxy_steps.py + tests that fail CI if any job skips the proxy.

Commit 2 — ci: npm cooldown for installs, no gateway in publish, OIDC: the gateway cannot carry npm publish (it rejects PUT /<package>), which is why commit 1 had to delete the /etc/hosts pin mid-job in both publish workflows. Per secplatform's interim policy for OSS repos, publish workflows are exempt from the gateway and protected by the lockfile plus a release cooldown instead:

• .npmrc gets min-release-age=14 — aligned with the gateway's 14-day window (per Dima), so a freshly published version cannot enter package-lock.json. npm's directive is in days and needs npm >= 11.10.0.
• Both publish workflows drop the gateway action and the sed -i /etc/hosts unpin. The exemption is recorded explicitly in PUBLISH_WORKFLOWS in check_wix_proxy_steps.py, so every other workflow — present and future — still fails CI without the proxy. Adding a file to that list is a reviewable security decision, not a config tweak.
• preview-publish.yml installs with npm ci, not npm install. With no gateway in front of the job, a resolving install was the only remaining step that could pull a fresh release. Both publish jobs now resolve nothing from the registry.
• Both bump to Node 24 and drop npm install -g npm@11, which fetched a floating npm release outside the cooldown. Node 24's bundled npm (>= 11.17) already covers trusted publishing (needs >= 11.5.1) and reads min-release-age (needs >= 11.10.0).
• Publish steps keep authenticating via npm trusted publishing (OIDC) — no NPM_TOKEN reaches the build. permissions moves to the job with a note on why each scope is there; packages: write goes away, since nothing here publishes to GHCR.

Verification

Run locally against this branch:

• check_wix_proxy_steps.py → verified 8 of 8 jobs across 8 workflows, plus Publish workflows exempt by policy: manual-publish.yml, preview-publish.yml
• python -m unittest test_check_wix_proxy_steps → 11 tests pass, including three new ones: a listed publish workflow may omit the proxy, exempt jobs are not counted as verified, and a workflow not on the list still fails without it
• package-lock.json is in sync with package.json, so the npm install → npm ci switch in preview-publish.yml is safe

Needs CI (and a couple of manual steps) to confirm:

• lint, unit-tests, security-audit, Check Wix Gateway Proxy pass on this PR
• preview-publish publishes @base44-preview/sdk on Node 24 via OIDC — needs a trusted publisher registered on npmjs.com for @base44-preview/sdk against this repo + preview-publish.yml. The registry keys on the workflow filename, so this is a separate entry from manual-publish.yml
• After merge: dispatch Manual Package Publish with dry_run=true
• After merge: dispatch wix gateway proxy check and Security Audit (npm audit POSTs to the registry's bulk-advisory endpoint through the pinned gateway — if the gateway doesn't proxy it, the weekly audit fails loudly)
• Consider making Check Wix Gateway Proxy a required status check

Not in scope

The org's new SHA-lock policy for third-party actions (cli#600) applies here too — peter-evans/repository-dispatch@v4, actions/create-release@v1 and friends are still floating tags. Separate PR.

The Node 20 jobs (lint, unit-tests, security-audit) will each print one npm warn Unknown project config "min-release-age" line. They're gatewayed, so the cooldown is enforced for them regardless.

---

🤖 Generated with Claude Code