SDK-7085 chore(security): add supply-chain hardening .npmrc

.changeset/pr-153.md

@@ -0,0 +1,5 @@
+---
+"@wdio/browserstack-service": patch
+---
+
+- Add repo-root .npmrc with supply-chain hardening directives (strict-ssl, save-exact,

.npmrc

@@ -0,0 +1,29 @@
+# nosemgrep: package_managers.npm.npm-missing-minimum-release-age
+#
+# min-release-age is intentionally not set. The rule wants a 7-day cooldown
+# before resolving newly published versions, but @wdio/browserstack-service ships
+# reactive WDIO ops fixes that cannot wait out a release-age window. This is a
+# false positive for this repo; suppressed per Security Ops book section 6.8
+# (Fix Semgrep False Positive in SCA). Ref: SDK-7085.
+#
+# Supply-chain hardening directives for npm installs in this repository.
+#
+# access=restricted is intentionally omitted: @wdio/browserstack-service is a
+# public npm package, so publishes must default to public access.
+#
+# ignore-scripts=true is intentionally deferred. The build runs `buf generate`
+# and esbuild, both of which fetch platform binaries via npm lifecycle
+# (postinstall) scripts; enabling ignore-scripts here leaves those binaries
+# unprovisioned and breaks `npm run build` in CI. Re-enable once CI provisions
+# the buf/esbuild binaries explicitly (an npm rebuild or a pinned install step).
+#
+# engine-strict=true is intentionally deferred. engines.node is ">=18.20.0" but
+# transitive dev deps frequently target newer Node, so strict enforcement raises
+# spurious EBADENGINE failures across the multi-Node CI matrix. Re-enable once CI
+# standardises on a single LTS that satisfies all transitive engine fields.
+
+strict-ssl=true
+save-exact=true
+audit-level=high
+
+legacy-peer-deps=false