chore: define install-script policy

.github/workflows/book-qa.yml

@@ -29,21 +29,43 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v6
         with:
-          node-version: '20'
+          node-version: '22.22.2'
           cache: npm
-          cache-dependency-path: book-formatter/package-lock.json
+          cache-dependency-path: |
+            package-lock.json
+            book-formatter/package-lock.json
+
+      - name: Verify pinned npm CLI
+        shell: bash
+        run: test "$(npx --yes npm@12.0.1 --version)" = "12.0.1"
 
       - name: Root dependency security audit
-        run: npm run check:security
+        run: npx --yes npm@12.0.1 audit
 
       - name: Book metadata consistency check
         run: node scripts/check-metadata-consistency.js
 
       - name: Check reader-facing checklist and figure contracts
         run: node scripts/check-issue-240-ux.js
 
-      - name: Install book dependencies for contract checks
-        run: npm ci --ignore-scripts
+      - name: Install book dependencies with policy npm
+        run: npx --yes npm@12.0.1 ci
+
+      - name: Check install-script allowlist contract
+        shell: bash
+        run: |
+          set -euo pipefail
+          node scripts/check-install-script-policy.js
+          node scripts/check-install-script-policy.js --self-test
+          report="$RUNNER_TEMP/install-scripts.json"
+          npx --yes npm@12.0.1 install-scripts ls --json > "$report"
+          node - "$report" <<'NODE'
+          const report = require(process.argv[2]);
+          if (!Array.isArray(report.allowScripts) || report.allowScripts.length !== 0) {
+            throw new Error('pending install scripts remain: ' + JSON.stringify(report));
+          }
+          console.log('npm install-scripts pending count: 0');
+          NODE
 
       - name: Check Chapter 8 CodeQL workflow contract
         run: |

AGENTS.md

@@ -29,7 +29,7 @@
 
 ## 5. ローカル検証（推奨）
 
-前提: Node.js `>=20`（`node --version` で確認）、Python 3 系。
+前提: Node.js `^22.22.2 || ^24.15.0 || >=26.0.0` と npm `12.0.1`（`node --version` / `npm --version` で確認）、Python 3 系。npm版は `package.json#packageManager` を正本とします。
 
 - `python3 scripts/validate_links.py docs`（内部/外部リンクの存在チェック）
 - `npm ci`（初回のみ）
@@ -44,4 +44,3 @@
 - 章参照や内部リンクが壊れていない
 - 変更範囲が過度に広がっていない
 - GitHub Actions の `Book QA` が PASS する
-