Trust signals: pinned actions, Scorecard, driver diff, README Security (#64)

.github/dependabot.yml

@@ -0,0 +1,9 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: monthly
+    groups:
+      actions:
+        patterns: ['*']

.github/workflows/codemod.yml

@@ -24,8 +24,8 @@ jobs:
       run:
         working-directory: codemod
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
         with:
           node-version: ${{ matrix.node }}
       - run: npm ci --ignore-scripts
@@ -39,8 +39,8 @@ jobs:
       run:
         working-directory: codemod
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
         with:
           node-version: '22'
       - run: npm ci --ignore-scripts
@@ -58,8 +58,8 @@ jobs:
       run:
         working-directory: codemod
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
         with:
           node-version: '22'
       - if: matrix.pm == 'pnpm'
@@ -75,8 +75,8 @@ jobs:
       run:
         working-directory: codemod
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
         with:
           node-version: '24'
       - run: |
@@ -99,8 +99,8 @@ jobs:
       run:
         working-directory: codemod
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
         with:
           node-version: '24'
           registry-url: https://registry.npmjs.org
@@ -127,8 +127,8 @@ jobs:
       run:
         working-directory: codemod
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
         with:
           node-version: '24'
       - run: npm install -g codemod@1.18.5

.github/workflows/scorecard.yml

@@ -0,0 +1,31 @@
+name: scorecard
+
+on:
+  push:
+    branches: [main]
+  schedule:
+    - cron: '17 4 * * 1'
+  workflow_dispatch:
+
+permissions: read-all
+
+jobs:
+  analysis:
+    name: OpenSSF Scorecard
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    permissions:
+      security-events: write
+      id-token: write
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+        with:
+          persist-credentials: false
+      - uses: ossf/scorecard-action@fa7117db83c52d787ae5a89f350999701505d78e
+        with:
+          results_file: results.sarif
+          results_format: sarif
+          publish_results: true
+      - uses: github/codeql-action/upload-sarif@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee
+        with:
+          sarif_file: results.sarif

.github/workflows/test.yml

@@ -8,6 +8,9 @@ on:
   pull_request:
     paths-ignore: ['**/*.md', 'codemod/**', '.github/workflows/codemod.yml']
 
+permissions:
+  contents: read
+
 env:
   NODE_OPTIONS: --unhandled-rejections=strict
   PGUSER: postgres
@@ -25,11 +28,11 @@ jobs:
     runs-on: ubuntu-24.04
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
       - uses: ./.github/actions/setup-postgres
         with:
           version: ${{ matrix.postgres }}
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
         with:
           node-version: ${{ matrix.node }}
       - run: |
@@ -44,14 +47,14 @@ jobs:
     runs-on: ubuntu-24.04
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
       - uses: ./.github/actions/setup-postgres
         with:
           version: '17'
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
         with:
           node-version: '24'
-      - uses: denoland/setup-deno@v1
+      - uses: denoland/setup-deno@11b63cf76cfcafb4e43f97b6cad24d8e8438f62d
         with:
           deno-version: v1.46.3
       - run: npm run test:deno
@@ -63,8 +66,8 @@ jobs:
     env:
       POSTGRES_VERSION: '17'
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
         with:
           node-version: '24'
       - uses: ./.github/actions/setup-postgres
@@ -88,8 +91,8 @@ jobs:
     runs-on: ubuntu-24.04
     timeout-minutes: 5
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
         with:
           node-version: '24'
       - run: npm install --no-save eslint@8.57.1
@@ -108,13 +111,18 @@ jobs:
       contents: read
       id-token: write
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
         with:
           node-version: '24'
           registry-url: https://registry.npmjs.org
       - run: npm install -g npm@12
       - run: test "v$(node -p 'require("./package.json").version')" = "$GITHUB_REF_NAME"
+      - name: Check docs/changes-since-3.4.9.diff is current
+        run: |
+          git fetch --no-tags --depth=1 origin tag v3.4.9
+          npm run -s diff:upstream
+          git diff --exit-code docs/changes-since-3.4.9.diff
       - run: npm install --no-save eslint@8.57.1
       - run: npm stage publish --tag ${{ contains(github.ref_name, '-') && 'next' || 'latest' }}
       - name: Move next once the staged version is approved

README.md

@@ -69,9 +69,9 @@ The alias above works with `drizzle-orm/postgres-js`, `drizzle-kit`, `kysely-pos
 
 ## Security
 
-Published from GitHub Actions through npm trusted publishing, with provenance and maintainer approval using two-factor authentication. No stored npm token, runtime dependencies or registry install scripts. Verify with `npm audit signatures`.
+Maintained by [Oleg Komarov](https://github.com/okomarov). Since 4.5.0, every version is published from GitHub Actions through npm trusted publishing, with provenance and maintainer approval using two-factor authentication. No stored npm token, runtime dependencies or registry install scripts. Verify with `npm audit signatures`, or under Provenance at the bottom of the [npm page](https://www.npmjs.com/package/@steadybrew/postgresjs).
 
-[Changes since upstream 3.4.9](https://github.com/steadybrew/postgresjs/compare/v3.4.9...main) · [Report a vulnerability](SECURITY.md) · [Unlicense](UNLICENSE)
+[Driver changes since Postgres.js 3.4.9](docs/changes-since-3.4.9.diff) · [Report a vulnerability](SECURITY.md) · [Unlicense](UNLICENSE)
 
 ## Compatibility