Align Dependabot with pnpm's minimumReleaseAge supply-chain gate

[Copilot]

Dependabot PRs were failing CI outright because they bumped to package versions younger than pnpm's minimumReleaseAge supply-chain gate, which refuses to install a version until it's aged past a threshold — blocking merges even for routine updates.

Age gate

• Added pnpm-workspace.yaml pinning minimumReleaseAge: 1440 (24h) and minimumReleaseAgeStrict: false, so the policy is explicit rather than relying on a framework default that could shift between pnpm versions.

Dependabot scheduling

• Added cooldown: default-days: 1 to the npm ecosystem entry in .github/dependabot.yml so routine version-update PRs open only once they'd already clear the pnpm gate, keeping CI green on arrival.
• Cooldown does not apply to Dependabot security (CVE) updates — those still open immediately against a freshly-published fix, which can still trip the gate.

Security update fast-track

Added a two-stage workflow so urgent security bumps aren't stuck behind the 24h gate:

• Compute (dependabot-age-exempt-compute.yml, unprivileged, pull_request context): detects an age-gate failure, identifies the exact name@version the PR introduced, and proves an exemption resolves it before publishing it as a data-only artifact.
• Apply (dependabot-age-exempt-apply.yml, privileged, workflow_run from default branch): strictly validates the exemption data, then pushes a minimumReleaseAgeExclude entry to the Dependabot branch.

# pnpm-workspace.yaml
minimumReleaseAge: 1440
minimumReleaseAgeExclude:
  - 'lodash@4.17.22' # example: security-update exemption added by the fast-track

The split into unprivileged compute / privileged apply keeps untrusted PR-authored code from ever running with write access — only validated, data-only exemption entries cross into the trusted stage.

[Copilot]

Pull request overview

This PR aims to keep Dependabot PRs compatible with pnpm’s minimumReleaseAge supply-chain gate by delaying routine update PRs until versions are old enough, while adding a two-stage workflow to fast-track exemptions for urgent security updates without granting untrusted PR code write permissions.

Changes:

• Adds explicit pnpm age-gate configuration and an exclusion list for narrowly scoped security exemptions.
• Configures Dependabot to delay routine npm update PRs via cooldown.
• Introduces a compute/apply GitHub Actions workflow pair plus scripts to automatically add validated minimumReleaseAgeExclude entries to Dependabot branches when needed.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
pnpm-workspace.yaml	Introduces explicit minimum release age settings and an exemption list for fast-tracked security updates.
.github/dependabot.yml	Adds Dependabot cooldown so routine PRs wait until versions clear the age gate.
.github/workflows/dependabot-age-exempt-compute.yml	Unprivileged workflow to detect age-gate failures and compute validated exemption entries as an artifact.
.github/workflows/dependabot-age-exempt-apply.yml	Privileged workflow_run stage that validates artifact data and pushes exemptions to the Dependabot branch.
.github/scripts/dependabot-age-compute.mjs	Computes and proves which name@version exemptions unblock a frozen pnpm install.
.github/scripts/dependabot-age-apply.mjs	Validates artifact input, edits pnpm-workspace.yaml on the Dependabot branch, and pushes a commit.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.