chore: fix CI/CD tasks and apply some basic hardening

Author: ericrallen

.github/workflows/publish-typescript.yml

@@ -26,6 +26,9 @@ jobs:
           node-version: "24"
           registry-url: "https://registry.npmjs.org"
 
+      - name: Configure npm release age gate
+        run: echo "NPM_CONFIG_BEFORE=$(date -u -d '7 days ago' +'%Y-%m-%dT%H:%M:%SZ')" >> "$GITHUB_ENV"
+
       - name: Install dependencies
         run: npm ci
 

.github/workflows/validate.yml

@@ -16,22 +16,17 @@ jobs:
         with:
           node-version: "20"
 
+      - name: Configure npm release age gate
+        run: echo "NPM_CONFIG_BEFORE=$(date -u -d '7 days ago' +'%Y-%m-%dT%H:%M:%SZ')" >> "$GITHUB_ENV"
+
+      - name: Install validation dependencies
+        run: npm ci
+
       - name: Validate models YAML against schema
-        run: |
-          npm install ajv ajv-cli
-          npx ajv validate \
-            -s model-metadata.schema.json \
-            -d "models/*.yaml" \
-            --spec=draft2020 \
-            --all-errors || exit 1
+        run: npm run validate:models
 
       - name: Validate providers YAML against schema
-        run: |
-          npx ajv validate \
-            -s provider.schema.json \
-            -d "providers/*.yaml" \
-            --spec=draft2020 \
-            --all-errors || exit 1
+        run: npm run validate:providers
 
   codegen:
     runs-on: ubuntu-latest
@@ -48,7 +43,7 @@ jobs:
       - name: Check for changes
         run: |
           git diff --exit-code packages/typescript/src/generated/
-          git diff --exit-code packages/python/model_metadata/generated/
+          git diff --exit-code packages/python/model_metadata_central/generated/
 
   typescript:
     runs-on: ubuntu-latest
@@ -63,6 +58,9 @@ jobs:
           node-version: "20"
           registry-url: "https://registry.npmjs.org"
 
+      - name: Configure npm release age gate
+        run: echo "NPM_CONFIG_BEFORE=$(date -u -d '7 days ago' +'%Y-%m-%dT%H:%M:%SZ')" >> "$GITHUB_ENV"
+
       - name: Install deps and type-check
         run: npm ci && npm run lint
 
@@ -81,15 +79,15 @@ jobs:
           python-version: "3.10"
 
       - name: Install dependencies
-        run: uv sync
+        run: uv sync --locked
 
       - name: Build registry from YAML sources
         run: uv run python scripts/build_registry.py
 
       - name: Type-check generated models
         run: |
           uv run python -c "
-          from model_metadata.generated.models import ModelMetadata, ProviderMetadata
+          from model_metadata_central.generated.models import ModelMetadata, ProviderMetadata
           m = ModelMetadata.model_validate({
               'model_id': 'test',
               'model_type': 'chat',
@@ -103,4 +101,4 @@ jobs:
               'routing_priority': 'direct'
           })
           print('ProviderMetadata valid:', p.provider_id)
-          "
+          "

.npmrc

@@ -0,0 +1,2 @@
+min-release-age=7
+save-exact=true

package-lock.json

@@ -1,7 +1,19 @@
 {
   "name": "model-metadata-central",
   "private": true,
+  "packageManager": "npm@11.16.0",
+  "engines": {
+    "node": ">=20",
+    "npm": ">=11.16.0"
+  },
   "scripts": {
-    "generate": "node scripts/codegen.mjs"
+    "generate": "node scripts/codegen.mjs",
+    "validate:models": "node scripts/validate-yaml-schema.mjs model-metadata.schema.json models",
+    "validate:providers": "node scripts/validate-yaml-schema.mjs provider.schema.json providers"
+  },
+  "devDependencies": {
+    "ajv": "8.20.0",
+    "ajv-formats": "3.0.1",
+    "yaml": "3.0.0-0"
   }
-}
+}

package.json

@@ -0,0 +1,2 @@
+min-release-age=7
+save-exact=true

packages/typescript/.npmrc

@@ -10,6 +10,9 @@
   "type": "module",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
+  "engines": {
+    "node": ">=20"
+  },
   "exports": {
     ".": {
       "import": "./dist/index.js",

packages/typescript/package-lock.json

@@ -0,0 +1,47 @@
+import fs from "node:fs";
+import path from "node:path";
+import process from "node:process";
+import Ajv2020 from "ajv/dist/2020.js";
+import addFormats from "ajv-formats";
+import { parse } from "yaml";
+
+const [schemaPath, dataDir] = process.argv.slice(2);
+
+if (!schemaPath || !dataDir) {
+  console.error("Usage: node scripts/validate-yaml-schema.mjs <schema.json> <data-dir>");
+  process.exit(2);
+}
+
+const schema = JSON.parse(fs.readFileSync(schemaPath, "utf8"));
+const ajv = new Ajv2020({ allErrors: true });
+addFormats(ajv);
+
+const validate = ajv.compile(schema);
+const yamlFiles = fs
+  .readdirSync(dataDir)
+  .filter((file) => file.endsWith(".yaml") || file.endsWith(".yml"))
+  .sort();
+
+let hasErrors = false;
+
+for (const file of yamlFiles) {
+  const filePath = path.join(dataDir, file);
+  const data = parse(fs.readFileSync(filePath, "utf8"));
+
+  if (validate(data)) {
+    console.log(`${filePath} valid`);
+    continue;
+  }
+
+  hasErrors = true;
+  console.error(`${filePath} invalid`);
+
+  for (const error of validate.errors ?? []) {
+    const location = error.instancePath || "/";
+    console.error(`  ${location} ${error.message}`);
+  }
+}
+
+if (hasErrors) {
+  process.exit(1);
+}