fix(ci)!: refresh security and build workflows

[elkampu]

Summary

• refresh the .NET and Node build/release workflows to supported runtimes
• pin reusable actions to immutable commit SHAs and apply least-privilege workflow permissions
• replace the unauthenticated AuditJS scan with npm audit, add scheduled/manual dependency scans, and align the .NET scan with FINOS's cve-scanning.yml convention
• update @microsoft/signalr to 10.0.11 so the JavaScript client's production dependency audit is clean, then remove the obsolete advisory allow-list
• declare Node.js 22 as the JavaScript client's minimum runtime and test the supported Node.js 22 and 24 LTS lines
• prevent the write-scoped Doxygen checkout credential from being persisted into the workspace and broaden the .NET vulnerability scan triggers to dependency-control files

Compatibility

This changes the JavaScript client's declared minimum runtime from Node.js 10 to Node.js 22. Node.js 10 has long been end-of-life, Node.js 20 reached end-of-life in March 2026, and the updated CI matrix now covers the supported Node.js 22 and 24 LTS releases. The follow-up commit carries a BREAKING CHANGE footer so semantic-release does not present the dropped runtime support as a patch-only change.

Validation

• actionlint .github/workflows/*.yml
• .NET 10 build and tests (18 tests passed)
• JavaScript client on Node.js 22.23.2: npm ci, npm run lint, npm run build
• production dependency scan: npm ci --omit dev, npm audit --omit dev --audit-level high (0 vulnerabilities)
• node-license-validator with the repository's existing allow-list (passed)
• git diff --check

The JavaScript project currently has no runnable tests; Jest exits with No tests found. Its legacy TSDX development toolchain also still has audit findings, while the shipped production dependency tree is clean. Those development-tooling findings are intentionally kept separate from this focused workflow/security update and are tracked in #60.

Closes #58

[linux-foundation-easycla]

The committers listed above are authorized under a signed CLA.

• ✅ login: elkampu / name: el kampu (a4ddf9b)

[elkampu]

Hi @kriswest — I have pushed a follow-up addressing the review findings: the JavaScript client now declares Node.js 22+ and CI covers the supported Node.js 22/24 LTS lines, the Doxygen workflow no longer persists its write-scoped checkout credential, the .NET vulnerability scan watches dependency-control files, and the stale allow-list path filter is removed. The runtime compatibility change is called out explicitly in the PR description and commit metadata.

I reran actionlint, the .NET build and tests (18 passed), the JavaScript lint/build on Node.js 22.23.2, the production npm audit (0 vulnerabilities), the license check, and git diff --check locally.

EasyCLA is green. GitHub currently shows the five fork-triggered workflows for the new head as awaiting approval, and CodeQL is disabled due to inactivity. When convenient, could you approve those workflow runs, re-enable CodeQL, and review the PR? I can update the branch again if GitHub needs a new synchronization event after CodeQL is enabled. Thanks!

[kriswest]

HI @elkampu, thanks for taking this on. It looks like the build is failing on the package-lock.json being out of sync with the package.json file. Could you run an npm install locally and check-in the result? That should resolve the issue

[elkampu]

Thanks, @kriswest — fixed in 403ebd0. I regenerated package-lock.json and verified npm ci, lint, and build on Node 22.23.2 and 24.16.0.

The fork-triggered checks are awaiting approval again; could you approve them when convenient? Thanks!