feat: implement issue #303 — SonarCloud: GitHub Actions / dependency hardening (×11)

.github/workflows/ci.yml

@@ -74,7 +74,7 @@ jobs:
         run: go build ./cmd/api/
 
       - name: Validate GraphQL schema
-        run: go run github.com/99designs/gqlgen validate
+        run: go run github.com/99designs/gqlgen@v0.17.49 validate
 
       - name: Unit tests
         run: go test ./... -short -count=1
@@ -106,26 +106,26 @@ jobs:
 
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
-          node-version: lts/*
+          node-version: "22.15.0"
           cache: npm
 
       - name: Install dependencies
-        run: npm ci
+        run: npm ci --ignore-scripts
 
       - name: Type check
-        run: npx tsc --noEmit
+        run: npx --no-install tsc --noEmit
 
       - name: Lint
-        run: npx eslint . --max-warnings 0
+        run: npx --no-install eslint . --max-warnings 0
 
       - name: Format check
-        run: npx prettier --check .
+        run: npx --no-install prettier --check .
 
       - name: GraphQL codegen check
-        run: npx graphql-codegen --check
+        run: npx --no-install graphql-codegen --check
 
       - name: Test + coverage (≥80% branch and line)
-        run: npx jest --ci --coverage --coverageThreshold='{"global":{"lines":80,"branches":80}}'
+        run: npx --no-install jest --ci --coverage --coverageThreshold='{"global":{"lines":80,"branches":80}}'
 
   # ── Secret scanning ────────────────────────────────────────────────────────
   secret-scan: