Tag

Blocks inline script and restricts everything to the origin. Tighten from here rather than loosening from nothing.

Verifies a download actually matches what the publisher signed, rather than trusting the transfer.

Node's mock timers make anything date-dependent deterministic without injecting a clock everywhere.

Caches the dependency install, runs on a matrix of versions, and fails the build on a lint error.

Running make with no arguments prints every target that carries a comment.

Names the built file after its contents so a deploy invalidates the cache without a version bump.

Caret ranges are how a build that passed last week fails today. Exact versions plus a lockfile remove the surprise.