chore: Shai hulud compliance

[itaisinai]

Background

Wix employees need to work against Wix's internal NPM registry since the public registry is blocked on Wix network. To enable CI/CD and npm.js publishing for open-source projects in non-"wix-private" repositories, we need to comply with specific security requirements.

Summary

This PR implements the required security compliance (Shai Hulud) and migrates the project from npm to yarn to support the internal registry workflow.

Main Changes:

1. Migrated from npm to yarn:

   • Removed package-lock.json and added yarn.lock
   • Added .yarnrc.yml configured to use npmRegistryServer: https://registry.npmjs.org
   • Added yarn 4.12.0 binary (.yarn/releases/yarn-4.12.0.cjs)
   • Updated all npm commands to yarn across all package.json files
   • Updated lerna.json to use yarn as npmClient
   • Added packageManager: "[email protected]" to root package.json

2. Upgraded Node.js: Updated from 16.20.0 to 22.10.0 (updated .nvmrc and workflow files)

3. Security compliance for CI/CD:

   • Pinned GitHub Actions to commit SHAs: Replaced @v4 tags with specific commit SHAs for actions/checkout and actions/setup-node to ensure reproducible and secure builds
   • Added npq for package installation: Replaced all yarn install commands with NPQ_PKG_MGR=yarn npx npq install to audit npm packages before installation

Files changed:

• .github/workflows/node.yml - Updated all 4 jobs (lint, tests, deploy, update-playground)
• .nvmrc - Updated Node version
• .yarnrc.yml - Added yarn configuration with internal registry settings
• yarn.lock - Added yarn lockfile
• package-lock.json - Removed
• package.json (root and all packages) - Updated scripts to use yarn
• lerna.json - Configured to use yarn

[itaisinai]

#rebuild

[itaisinai]

#rebuild