Add a security workflow

Signed-off-by: Steven Sheehy <steven.sheehy@swirldslabs.com>

Author: steven-sheehy

.github/workflows/security.yaml

@@ -22,7 +22,6 @@ env:
   LC_ALL: C.UTF-8
 
 permissions:
-  actions: read
   contents: read
 
 concurrency:
@@ -41,8 +40,6 @@ jobs:
 
       - name: Install pnpm
         uses: step-security/action-setup@0ad50dc56a23060fa78b14cfcf0677c4e14b42bc # v5.0.0
-        with:
-          version: 9.15.3
 
       - name: Set up Node.js
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
@@ -72,8 +69,6 @@ jobs:
 
       - name: Install pnpm
         uses: step-security/action-setup@0ad50dc56a23060fa78b14cfcf0677c4e14b42bc # v5.0.0
-        with:
-          version: 9.15.3
 
       - name: Set up Node.js
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
@@ -96,8 +91,6 @@ jobs:
 
       - name: Install pnpm
         uses: step-security/action-setup@0ad50dc56a23060fa78b14cfcf0677c4e14b42bc # v5.0.0
-        with:
-          version: 9.15.3
 
       - name: Set up Node.js
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
@@ -114,9 +107,10 @@ jobs:
         run: pip install semgrep
 
       - name: Run Semgrep
-        run: semgrep scan --sarif --output semgrep.sarif
+        run: semgrep scan --error --sarif --output semgrep.sarif
 
       - name: Upload SARIF
         uses: github/codeql-action/upload-sarif@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v4.35.4
         with:
+          category: semgrep
           sarif_file: semgrep.sarif

package.json

@@ -4,6 +4,7 @@
   "devDependencies": {
     "prettier": "catalog:"
   },
+  "packageManager": "pnpm@9.15.9+sha512.68046141893c66fad01c079231128e9afb89ef87e2691d69e4d40eee228988295fd4682181bae55b58418c3a253bde65a505ec7c5f9403ece5cc3cd37dcf2531",
   "pnpm": {
     "overrides": {
       "protobufjs@<8.0.0": "7.5.8",
@@ -31,6 +32,6 @@
     }
   },
   "engines": {
-    "node": ">=24.0.0"
+    "node": ">=24.15.0 <25"
   }
 }