Fix: Enforce documentation supply-chain quality gates and dependency security,strict TypeScript boundaries and eliminate unbounded any usage

.github/actions/base-setup/action.yaml

@@ -4,8 +4,9 @@ runs:
   using: "composite"
   steps:
     - name: Setup pnpm
-      uses: pnpm/action-setup@v2
+      uses: pnpm/action-setup@v4
       with:
+        version: 9.12.3
         run_install: false
 
     - name: Setup Node 22
@@ -19,13 +20,16 @@ runs:
       shell: bash
       run: echo "STORE_PATH=$(pnpm store path)" >> $GITHUB_OUTPUT
 
-    - name: Restore Cache
+    - name: Restore pnpm store cache
       uses: actions/cache@v4
       with:
-        path: |
-          ${{ steps.pnpm-cache.outputs.STORE_PATH }}
-          **/node_modules
+        path: ${{ steps.pnpm-cache.outputs.STORE_PATH }}
         key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }}
         restore-keys: |
           ${{ runner.os }}-pnpm-store-
 
+    # SECURITY FIX: Install dependencies using a frozen lockfile to guarantee 
+    # deterministic CI behavior and prevent supply chain drift.
+    - name: Install dependencies
+      shell: bash
+      run: pnpm install --frozen-lockfile

.github/workflows/cicd.yaml

@@ -1,4 +1,3 @@
-name: CI/CD Workflow
 on:
   pull_request:
   push:
@@ -10,37 +9,8 @@ jobs:
     uses: inkonchain/.github/.github/workflows/securesdlc.yml@main
     secrets: inherit
 
-  install_modules:
-    needs: securesdlc
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: volta-cli/action@v4
-      - uses: pnpm/action-setup@v4
-        with:
-          run_install: false
-      - uses: actions/setup-node@v4
-        with:
-          node-version: "22.x"
-          cache: "pnpm"
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Add pnpm store path to env var
-        id: pnpm-cache
-        shell: bash
-        run: echo "STORE_PATH=$(pnpm store path)" >> $GITHUB_OUTPUT
-      - name: Cache node modules
-        uses: actions/cache@v4
-        with:
-          path: |
-            ${{ steps.pnpm-cache.outputs.STORE_PATH }}
-            **/node_modules
-          key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }}
-          restore-keys: |
-            ${{ runner.os }}-pnpm-store-
-
   js-lint:
-    needs: install_modules
+    needs: securesdlc
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
@@ -50,7 +20,7 @@ jobs:
         run: pnpm run lint:js
 
   md-lint:
-    needs: install_modules
+    needs: securesdlc
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
@@ -60,39 +30,42 @@ jobs:
         run: pnpm run lint:mdx
 
   format:
-    needs: install_modules
+    needs: securesdlc
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
       - uses: ./.github/actions/base-setup
         name: Base Setup
-      - name: Run formatting
-        run: pnpm run format:js
+      # SECURITY/QUALITY FIX: Changed from mutating `format:js` to `format:js:check` 
+      # so CI fails on drift instead of silently modifying the checkout.
+      - name: Check formatting
+        run: pnpm run format:js:check
 
-  # spell-check:
-  #   needs: install_modules
-  #   runs-on: ubuntu-latest
-  #   steps:
-  #     - uses: actions/checkout@v4
-  #     - uses: ./.github/actions/base-setup
-  #       name: Base Setup
-  #     - name: Run Spellcheck
-  #       run: pnpm run spellcheck:lint
+  spell-check:
+    needs: securesdlc
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: ./.github/actions/base-setup
+        name: Base Setup
+      # QUALITY FIX: Re-enabled the active spell-check job to enforce documentation quality.
+      - name: Run spell-check
+        run: pnpm run spellcheck:lint
 
   build:
-    needs: install_modules
+    needs: securesdlc
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
       - uses: ./.github/actions/base-setup
         name: Base Setup
-      - name: Building app
+      - name: Build application
         run: pnpm run build
       - name: Cache build
         uses: actions/cache/save@v4
         with:
           path: .next
-          key: ${{ runner.os }}-build-store-${{ hashFiles('.next') }}
+          key: ${{ runner.os }}-build-store-${{ hashFiles('**/pnpm-lock.yaml') }}
 
   docker-publish:
     if: github.ref == 'refs/heads/main'
@@ -103,17 +76,17 @@ jobs:
         uses: actions/checkout@v4
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v2
+        uses: docker/setup-buildx-action@v3
 
       - name: Log in to GitHub Container Registry
-        uses: docker/login-action@v2
+        uses: docker/login-action@v3
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Build and push Docker image
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@v6
         with:
           context: .
           push: true

global-env.d.ts

@@ -1,3 +1,24 @@
-interface Window {
-  ethereum: any;
+// QUALITY FIX: Strict EIP-1193 provider interfaces replacing the ambient 'any' type
+// to ensure type-safe interactions with the browser wallet boundary.
+declare global {
+  interface EIP1193RequestArguments {
+    method: string;
+    params?: readonly unknown[];
+  }
+
+  interface EIP1193Provider {
+    request(args: EIP1193RequestArguments): Promise<unknown>;
+    on(event: "chainChanged", listener: (chainId: string) => void): void;
+    removeListener(
+      event: "chainChanged",
+      listener: (chainId: string) => void
+    ): void;
+  }
+
+  interface Window {
+    // QUALITY FIX: Typed explicitly as EIP1193Provider instead of 'any'
+    ethereum?: EIP1193Provider;
+  }
 }
+
+export {};

next.config.mjs

@@ -1,36 +1,35 @@
-import nextra from "nextra";
-import path from "path";
-import remarkCodeImport from "remark-code-import";
-import { fileURLToPath } from "url";
-
-const __dirname = path.dirname(fileURLToPath(import.meta.url));
-
-const withNextra = nextra({
-  theme: "nextra-theme-docs",
-  themeConfig: "./theme.config.tsx",
-  defaultShowCopyCode: true,
-  mdxOptions: {
-    remarkPlugins: [remarkCodeImport],
-  },
-});
-
-const config = withNextra({
-  eslint: {
-    ignoreDuringBuilds: true,
-  },
-  images: {
-    unoptimized: true,
-  },
-  webpack: (config) => {
-    config.resolve.alias = {
-      ...config.resolve.alias,
-      "@": path.join(__dirname, "src"),
-    };
-    return config;
-  },
-  experimental: {
-    mdxRs: true,
-  },
-});
-
-export default config;
+import nextra from "nextra";
+import path from "path";
+import remarkCodeImport from "remark-code-import";
+import { fileURLToPath } from "url";
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+
+const withNextra = nextra({
+  theme: "nextra-theme-docs",
+  themeConfig: "./theme.config.tsx",
+  defaultShowCopyCode: true,
+  mdxOptions: {
+    remarkPlugins: [remarkCodeImport],
+  },
+});
+
+// SECURITY FIX: The vulnerable `ignoreDuringBuilds: true` bypass has been removed 
+// from the ESLint configuration, ensuring production builds enforce repository linting rules.
+const config = withNextra({
+  images: {
+    unoptimized: true,
+  },
+  webpack: (config) => {
+    config.resolve.alias = {
+      ...config.resolve.alias,
+      "@": path.join(__dirname, "src"),
+    };
+    return config;
+  },
+  experimental: {
+    mdxRs: true,
+  },
+});
+
+export default config;

package.json

@@ -5,6 +5,24 @@
     "pnpm": "9.12.3"
   },
   "packageManager": "pnpm@9.12.3",
+  "pnpm": {
+    "overrides": {
+      "cross-spawn": "6.0.6",
+      "diff": "5.2.2",
+      "dompurify": "3.4.13",
+      "estree-util-value-to-estree": "3.3.3",
+      "js-yaml@^3.0.0": "3.15.1",
+      "js-yaml@^4.0.0": "4.3.1",
+      "lodash-es": "4.18.0",
+      "mermaid": "10.9.8",
+      "postcss": "8.5.23",
+      "nanoid": "3.3.18",
+      "next-mdx-remote": "6.0.0",
+      "picomatch": "2.3.2",
+      "sharp": "0.35.0",
+      "yaml": "2.8.3"
+    }
+  },
   "scripts": {
     "dev": "next dev",
     "build": "next build",
@@ -52,7 +70,7 @@
   },
   "dependencies": {
     "clsx": "2.1.1",
-    "next": "15.5.10",
+    "next": "15.5.21",
     "next-sitemap": "4.2.3",
     "next-themes": "0.4.6",
     "nextra": "2.13.4",
@@ -69,13 +87,13 @@
     "autoprefixer": "10.4.21",
     "cspell": "9.2.0",
     "eslint": "9.32.0",
-    "eslint-config-next": "15.5.10",
+    "eslint-config-next": "15.5.21",
     "eslint-config-prettier": "10.1.8",
     "eslint-plugin-import": "2.32.0",
     "eslint-plugin-mdx": "3.6.2",
     "eslint-plugin-simple-import-sort": "12.1.1",
     "mdx": "0.3.1",
-    "postcss": "8.5.6",
+    "postcss": "8.5.23",
     "prettier": "3.6.2",
     "remark": "15.0.1",
     "remark-cli": "12.0.1",
@@ -95,4 +113,4 @@
     "tailwindcss": "3.4.17",
     "typescript": "5.8.3"
   }
-}
+}