Update publish flow and add dependency-age check (PLAYBACK-348, BROWSE-451)

[LukeBBC]

Summary of changes:

• Update publish flow to use

@bbc/[email protected] publish:safe
SAFE_PUBLISH=1 node ./scripts/guard-publish.js

Restored package.json private:true and add .npmrc for security

• Add DependencyAge check to PR CI pipeline

Tickets:

• PLAYBACK-348
• BROWSE-451

[Copilot]

Pull Request Overview

This PR implements a secure publish flow and adds dependency age checking to the CI pipeline. The changes prevent accidental package publishing by introducing a guard script and enforcing stricter npm configurations.

• Introduces a guard script that requires explicit environment variable to publish, with automatic cleanup of package.json state
• Updates package.json to be private by default and pins Node.js version to 22.18.0
• Adds .npmrc configuration for enhanced security and reproducibility

Reviewed Changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
scripts/guard-publish.js	New guard script that enforces safe publishing workflow with automatic state restoration
package.json	Sets package to private, updates Node.js version constraint, reorganizes test scripts, and adds safe publish command
.npmrc	Adds npm configuration for exact versions, script safety, and engine enforcement

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.