chore: migrate to mise + bump yarn to 4.14.1 + cache pattern (#93)

* chore: migrate to mise + bump yarn to 4.14.1 + cache pattern

- Replace volta block in package.json with mise.toml at repo root.
- Bump packageManager to yarn@4.14.1 (root + functions/).
- Lockfile metadata 8 -> 9.
- Delete .nvmrc (stale, conflicted with mise.toml; mise is source of truth).
- .yarnrc.yml: nodeLinker: node-modules, enableScripts: true,
  enableHardenedMode: false. Drop auto-added 'approvedGitRepositories: ["**"]'
  (no git deps in this project; it was a permissive default to nothing).
- Workflow main.yml: takken.io cache pattern applied to all 4 jobs
  (test, build, testDeploy, deploy). Each job now reads Node from
  mise.toml, caches node_modules + yarn cacheFolder + install-state,
  sets YARN_ENABLE_HARDENED_MODE: 'false' on install.

Yarn workspaces structure preserved (single root yarn.lock; functions/
inherits). Firebase-specific Cloud Build quirks (compressionLevel pin)
not needed here because there's no separate functions/ install --
Cloud Build runs against the root workspace.

Yarn 4.x -> 4.14.1: lockfile metadata bump, scripts default flipped;
within-major (no API breakage).

Note: firebase-functions ^6.1.0 and firebase-admin ^12.7.0 are major
versions behind current (7.2.5, 13.8.0). Not bumped here -- separate
PR with release notes review per the global Upgrades rule.

* chore(yarn): enableScripts off, allowlist via dependenciesMeta

Drop enableScripts: true (Yarn 4.14 default is false for security).
Allowlist each package that legitimately needs install scripts via
dependenciesMeta.X.built: true in package.json.

This shrinks the supply-chain RCE blast radius from 'every dep
running install code' to only the listed packages.

* chore(yarn): allowlist build scripts via dependenciesMeta

Force-fresh yarn install identified the packages with install
scripts. Added dependenciesMeta.X.built: true for each so they
build under the global enableScripts: false default.

* chore(yarn): update lockfile for dependenciesMeta

dependenciesMeta entries change the lockfile's resolution hash. Without
this commit, CI's yarn install --immutable would error with 'lockfile
would have been modified'.

* chore(mise): pin yarn alongside node in mise.toml

`mise install` now brings up both node and yarn — no separate
`corepack enable` step needed for fresh checkouts. Mirrors the
yarn version already in package.json's packageManager field.

Author: webbertakken

.github/workflows/main.yml

@@ -12,6 +12,12 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
+      - name: Read Node version from mise.toml
+        id: node
+        run:
+          echo "version=$(grep -E '^node\s*=' mise.toml | sed -E 's/.*"([^"]+)".*/\1/')" >>
+          "$GITHUB_OUTPUT"
+
       - name: Install package manager (from package.json)
         run: |
           corepack enable
@@ -20,11 +26,32 @@ jobs:
       - name: Setup Node
         uses: actions/setup-node@v4
         with:
-          node-version-file: package.json
-          cache: 'yarn'
+          node-version: ${{ steps.node.outputs.version }}
+
+      - name: Resolve yarn cache folder
+        id: yarn-config
+        run: echo "cacheFolder=$(yarn config get cacheFolder)" >> "$GITHUB_OUTPUT"
+
+      - name: Restore yarn install cache (node_modules + cacheFolder + install-state)
+        id: yarn-cache
+        uses: actions/cache@v4
+        with:
+          path: |
+            node_modules
+            ${{ steps.yarn-config.outputs.cacheFolder }}
+            .yarn/install-state.gz
+          key:
+            yarn-${{ runner.os }}-node${{ steps.node.outputs.version }}-${{
+            hashFiles('yarn.lock') }}
+          restore-keys: |
+            yarn-${{ runner.os }}-node${{ steps.node.outputs.version }}-
 
       - name: Install deps
-        run: yarn install --immutable
+        env:
+          YARN_ENABLE_HARDENED_MODE: 'false'
+        run: |
+          case "$(yarn --version)" in 1.*) echo 'expected up-to-date yarn version'; exit 1 ;; esac
+          yarn install --immutable
 
       - name: run linter
         run: yarn lint
@@ -53,6 +80,12 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
+      - name: Read Node version from mise.toml
+        id: node
+        run:
+          echo "version=$(grep -E '^node\s*=' mise.toml | sed -E 's/.*"([^"]+)".*/\1/')" >>
+          "$GITHUB_OUTPUT"
+
       - name: Install package manager (from package.json)
         run: |
           corepack enable
@@ -61,11 +94,32 @@ jobs:
       - name: Setup Node
         uses: actions/setup-node@v4
         with:
-          node-version-file: package.json
-          cache: 'yarn'
+          node-version: ${{ steps.node.outputs.version }}
+
+      - name: Resolve yarn cache folder
+        id: yarn-config
+        run: echo "cacheFolder=$(yarn config get cacheFolder)" >> "$GITHUB_OUTPUT"
+
+      - name: Restore yarn install cache (node_modules + cacheFolder + install-state)
+        id: yarn-cache
+        uses: actions/cache@v4
+        with:
+          path: |
+            node_modules
+            ${{ steps.yarn-config.outputs.cacheFolder }}
+            .yarn/install-state.gz
+          key:
+            yarn-${{ runner.os }}-node${{ steps.node.outputs.version }}-${{
+            hashFiles('yarn.lock') }}
+          restore-keys: |
+            yarn-${{ runner.os }}-node${{ steps.node.outputs.version }}-
 
       - name: Install deps
-        run: yarn install --immutable
+        env:
+          YARN_ENABLE_HARDENED_MODE: 'false'
+        run: |
+          case "$(yarn --version)" in 1.*) echo 'expected up-to-date yarn version'; exit 1 ;; esac
+          yarn install --immutable
 
       - name: build
         run: yarn workspace functions build
@@ -78,6 +132,12 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
+      - name: Read Node version from mise.toml
+        id: node
+        run:
+          echo "version=$(grep -E '^node\s*=' mise.toml | sed -E 's/.*"([^"]+)".*/\1/')" >>
+          "$GITHUB_OUTPUT"
+
       - name: Install package manager (from package.json)
         run: |
           corepack enable
@@ -86,11 +146,32 @@ jobs:
       - name: Setup Node
         uses: actions/setup-node@v4
         with:
-          node-version-file: package.json
-          cache: 'yarn'
+          node-version: ${{ steps.node.outputs.version }}
+
+      - name: Resolve yarn cache folder
+        id: yarn-config
+        run: echo "cacheFolder=$(yarn config get cacheFolder)" >> "$GITHUB_OUTPUT"
+
+      - name: Restore yarn install cache (node_modules + cacheFolder + install-state)
+        id: yarn-cache
+        uses: actions/cache@v4
+        with:
+          path: |
+            node_modules
+            ${{ steps.yarn-config.outputs.cacheFolder }}
+            .yarn/install-state.gz
+          key:
+            yarn-${{ runner.os }}-node${{ steps.node.outputs.version }}-${{
+            hashFiles('yarn.lock') }}
+          restore-keys: |
+            yarn-${{ runner.os }}-node${{ steps.node.outputs.version }}-
 
       - name: Install deps
-        run: yarn install
+        env:
+          YARN_ENABLE_HARDENED_MODE: 'false'
+        run: |
+          case "$(yarn --version)" in 1.*) echo 'expected up-to-date yarn version'; exit 1 ;; esac
+          yarn install --immutable
 
       - name: Deploy test to Firebase
         uses: w9jds/firebase-action@v14.19.0
@@ -116,6 +197,12 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
+      - name: Read Node version from mise.toml
+        id: node
+        run:
+          echo "version=$(grep -E '^node\s*=' mise.toml | sed -E 's/.*"([^"]+)".*/\1/')" >>
+          "$GITHUB_OUTPUT"
+
       - name: Install package manager (from package.json)
         run: |
           corepack enable
@@ -124,11 +211,32 @@ jobs:
       - name: Setup Node
         uses: actions/setup-node@v4
         with:
-          node-version-file: package.json
-          cache: 'yarn'
+          node-version: ${{ steps.node.outputs.version }}
+
+      - name: Resolve yarn cache folder
+        id: yarn-config
+        run: echo "cacheFolder=$(yarn config get cacheFolder)" >> "$GITHUB_OUTPUT"
+
+      - name: Restore yarn install cache (node_modules + cacheFolder + install-state)
+        id: yarn-cache
+        uses: actions/cache@v4
+        with:
+          path: |
+            node_modules
+            ${{ steps.yarn-config.outputs.cacheFolder }}
+            .yarn/install-state.gz
+          key:
+            yarn-${{ runner.os }}-node${{ steps.node.outputs.version }}-${{
+            hashFiles('yarn.lock') }}
+          restore-keys: |
+            yarn-${{ runner.os }}-node${{ steps.node.outputs.version }}-
 
       - name: Install deps
-        run: yarn install --immutable
+        env:
+          YARN_ENABLE_HARDENED_MODE: 'false'
+        run: |
+          case "$(yarn --version)" in 1.*) echo 'expected up-to-date yarn version'; exit 1 ;; esac
+          yarn install --immutable
 
       - name: Deploy to Firebase
         uses: w9jds/firebase-action@v14.19.0

.nvmrc

@@ -1,3 +1,8 @@
 nodeLinker: node-modules
 
+
+# Solo project; PRs are exclusively from the maintainer. Re-enable when
+# accepting third-party PRs that auto-trigger CI without manual review.
+enableHardenedMode: false
+
 npmRegistryServer: "https://registry.npmjs.org/"

.yarnrc.yml

@@ -9,7 +9,7 @@ This guide helps you set up the development environment for the GameCI Versionin
 - [Firebase CLI](https://firebase.google.com/docs/cli) for local development and deployment
 - [Java Runtime Environment](https://www.java.com/) for Firebase emulators
 
-> **Tip:** Use [nvm](https://github.com/nvm-sh/nvm), [n](https://github.com/tj/n), or [volta](https://volta.sh/) to manage Node.js versions.
+> **Tip:** This repo uses [mise](https://mise.jdx.dev/) (`mise.toml`) to pin the Node version. Run `mise install` in the repo root.
 
 ## Setup
 

DEVELOPMENT.md

@@ -46,9 +46,5 @@
     "jest": "^29.7.0"
   },
   "private": true,
-  "volta": {
-    "node": "24.12.0",
-    "yarn": "4.12.0"
-  },
-  "packageManager": "yarn@4.12.0"
+  "packageManager": "yarn@4.14.1"
 }

functions/package.json

@@ -0,0 +1,3 @@
+[tools]
+node = "24.12.0"
+yarn = "4.14.1"

mise.toml

@@ -61,9 +61,16 @@
     "typescript": "^5.9.3",
     "vitest": "^3.2.4"
   },
-  "volta": {
-    "node": "24.12.0",
-    "yarn": "4.12.0"
-  },
-  "packageManager": "yarn@4.12.0"
+  "packageManager": "yarn@4.14.1",
+  "dependenciesMeta": {
+    "esbuild": {
+      "built": true
+    },
+    "protobufjs": {
+      "built": true
+    },
+    "re2": {
+      "built": true
+    }
+  }
 }

package.json

@@ -2,7 +2,7 @@
 # Manual changes might be lost - proceed with caution!
 
 __metadata:
-  version: 8
+  version: 9
   cacheKey: 10c0
 
 "@ampproject/remapping@npm:^2.3.0":
@@ -12124,6 +12124,13 @@ __metadata:
     shellcheck: "npm:^4.1.0"
     typescript: "npm:^5.9.3"
     vitest: "npm:^3.2.4"
+  dependenciesMeta:
+    esbuild:
+      built: true
+    protobufjs:
+      built: true
+    re2:
+      built: true
   languageName: unknown
   linkType: soft