SNX-6286: Update SIPs package age settings

.github/workflows/PR-build.yml

@@ -9,13 +9,13 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
-      - uses: actions/setup-node@v2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
-          node-version: '20'
-      - name: Get latest npm version
-        run: npm install -g npm@latest --prefix .
+          node-version: '24'
+      - name: Enable pnpm via corepack
+        run: corepack enable
       - name: Install dependencies
-        run: npm install --prefer-offline --no-audit
+        run: pnpm install --frozen-lockfile
       - name: Validate SIP, STP, SR & SCCP frontmatters
-        run: npm test
+        run: pnpm test

.gitignore

@@ -4,3 +4,5 @@ public
 types/gql.ts
 .DS_Store
 .idea
+package-lock.json
+yarn.lock

.npmrc

@@ -0,0 +1,10 @@
+# This repo uses pnpm. npm and Yarn are intentionally disabled: the registry
+# below points at a dead address so a stray `npm install` / `yarn` fails fast
+# instead of resolving against the public registry. pnpm 11+ ignores these
+# non-auth settings and reads its registry from pnpm-workspace.yaml.
+engine-strict=true
+package-lock=false
+registry=http://127.0.0.1:1/
+fetch-retries=0
+fetch-retry-mintimeout=1
+fetch-retry-maxtimeout=1

.nvmrc

@@ -0,0 +1 @@
+24

README.md

@@ -36,10 +36,17 @@ SIPs must pass some validation tests.
 It is possible to run the SIP validator locally:
 
 ```
-npm install (if not done already)
-npm run test
+corepack enable        # one-time: activates the pinned pnpm version
+pnpm install           # if not done already
+pnpm test
 ```
 
+This repo uses **pnpm** and requires **Node.js 24+**. npm and Yarn are intentionally blocked. As supply-chain hardening, dependencies are gated to a 7-day minimum release age and dependency install scripts are disabled (see `pnpm-workspace.yaml`).
+
+## Deploying on Vercel
+
+`vercel.json` pins the build to pnpm via Corepack (`ENABLE_EXPERIMENTAL_COREPACK=1`) so Vercel honours the `packageManager` version in `package.json` (pnpm 11) instead of its built-in pnpm 9. If a build still fails with `Detected pnpm "9.x" is not compatible with engines.pnpm`, add `ENABLE_EXPERIMENTAL_COREPACK=1` as a Project Environment Variable (Settings → Environment Variables) — Corepack detection does not always read the value from `vercel.json`. Also ensure the project's Node.js Version is set to 24.x.
+
 # JSON API
 
 All SIPs & SCCPs data is available in JSON format by status at the following urls: