feat: add a permission audit script for generating LavaMoat configs

.github/workflows/build-lint-test.yml

@@ -6,6 +6,12 @@ on:
 permissions:
   contents: read
 
+env:
+  # How each command below is invoked. Jobs override this when debug logging is
+  # enabled, so that commands run through the permission audit rather than
+  # directly, without every step needing a second copy of itself.
+  RUN: yarn
+
 jobs:
   prepare:
     name: Prepare
@@ -36,7 +42,11 @@ jobs:
           is-high-risk-environment: false
           persist-credentials: false
           node-version: ${{ matrix.node-version }}
-      - run: yarn build
+      - name: Enable permission audit for debug runs
+        if: ${{ runner.debug == '1' && matrix.node-version == '26.x' }}
+        run: echo 'RUN=yarn audit-script --verbose' >> "$GITHUB_ENV"
+      - name: Build
+        run: $RUN build
       - name: Require clean working directory
         shell: bash
         run: |
@@ -59,13 +69,17 @@ jobs:
           is-high-risk-environment: false
           persist-credentials: false
           node-version: ${{ matrix.node-version }}
-      - run: yarn lint
+      - name: Enable permission audit for debug runs
+        if: ${{ runner.debug == '1' && matrix.node-version == '26.x' }}
+        run: echo 'RUN=yarn audit-script --verbose' >> "$GITHUB_ENV"
+      - name: Lint
+        run: $RUN lint
       - name: Validate RC changelog
         if: ${{ startsWith(github.head_ref, 'release/') }}
-        run: yarn lint:changelog --rc
+        run: $RUN lint:changelog --rc
       - name: Validate changelog
         if: ${{ !startsWith(github.head_ref, 'release/') }}
-        run: yarn lint:changelog
+        run: $RUN lint:changelog
       - name: Require clean working directory
         shell: bash
         run: |
@@ -88,7 +102,11 @@ jobs:
           is-high-risk-environment: false
           persist-credentials: false
           node-version: ${{ matrix.node-version }}
-      - run: yarn test
+      - name: Enable permission audit for debug runs
+        if: ${{ runner.debug == '1' && matrix.node-version == '26.x' }}
+        run: echo 'RUN=yarn audit-script --verbose' >> "$GITHUB_ENV"
+      - name: Test
+        run: $RUN test
       - name: Require clean working directory
         shell: bash
         run: |
@@ -113,7 +131,11 @@ jobs:
           node-version: ${{ matrix.node-version }}
       - name: Install dependencies via Yarn
         run: rm yarn.lock && YARN_ENABLE_IMMUTABLE_INSTALLS=false yarn
-      - run: yarn test
+      - name: Enable permission audit for debug runs
+        if: ${{ runner.debug == '1' && matrix.node-version == '26.x' }}
+        run: echo 'RUN=yarn audit-script --verbose' >> "$GITHUB_ENV"
+      - name: Test
+        run: $RUN test
       - name: Restore lockfile
         run: git restore yarn.lock
       - name: Require clean working directory

.nvmrc

@@ -1 +1 @@
-lts/*
+v26.9.0

package.json

@@ -27,6 +27,7 @@
     "registry": "https://registry.npmjs.org/"
   },
   "scripts": {
+    "audit-script": "node ./scripts/audit-script.ts",
     "build": "tsc --project tsconfig.build.json",
     "build:docs": "typedoc",
     "lint": "yarn lint:oxlint && yarn lint:constraints && yarn lint:misc --check && yarn lint:dependencies --check && yarn lint:changelog",
@@ -52,7 +53,8 @@
     "@metamask/oxlint-config-nodejs": "^0.1.1",
     "@metamask/oxlint-config-typescript": "^0.1.1",
     "@metamask/oxlint-config-vitest": "^0.1.1",
-    "@types/node": "^18.18",
+    "@types/node": "^26.6.2",
+    "@types/yargs": "^17.0.35",
     "@typescript/native": "npm:typescript@^7.0.2",
     "@vitest/coverage-istanbul": "^4.1.4",
     "@vitest/eslint-plugin": "^1.1.4",
@@ -65,7 +67,8 @@
     "typedoc": "^0.26.11",
     "typescript": "npm:@typescript/typescript6@^6.0.2",
     "vite": "^8.0.8",
-    "vitest": "^4.1.4"
+    "vitest": "^4.1.4",
+    "yargs": "^18.2.0"
   },
   "resolutions": {
     "fflate": "0.8.2"
@@ -88,6 +91,7 @@
   },
   "scriptsConfig": {
     "#default": "lavamoat/scripts.strict.json",
+    "audit-script": "lavamoat/scripts.yarn.json",
     "build": "lavamoat/scripts.build.json",
     "lint": "lavamoat/scripts.yarn.json",
     "lint:changelog": "lavamoat/scripts.lint.json",