ci(corepack): pinned the expected dev version of npm and explicitly used it for audit signatures

.gitattributes

@@ -0,0 +1 @@
+* text=auto eol=lf

.github/workflows/release.yml

@@ -24,7 +24,7 @@ jobs:
           node-version: lts/*
           cache: npm
       - run: npm clean-install
-      - run: npm audit signatures
+      - run: corepack npm audit signatures
       - run: npx semantic-release
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/test.yml

@@ -8,14 +8,22 @@ name: Test
     types:
       - opened
       - synchronize
+
+permissions:
+  contents: read
+
+env:
+  FORCE_COLOR: 1
+  NPM_CONFIG_COLOR: always
+
 jobs:
   test_matrix:
     strategy:
       matrix:
         node-version:
-          - 18.17.0
-          - 20.6.1
+          - 20.8.1
           - 20
+          - 21
         os:
           - ubuntu-latest
           - macos-latest
@@ -29,25 +37,28 @@ jobs:
           node-version: "${{ matrix.node-version }}"
           cache: npm
       - run: npm clean-install
-      - run: "npm run test:ci"
-  test:
+      - run: corepack npm audit signatures
+      - run: npm test
+
+  test_dev:
     runs-on: ubuntu-latest
-    needs: test_matrix
-    if: always()
     steps:
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
       - uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8 # v4.0.2
         with:
-          node-version: "lts/*"
+          node-version-file: .nvmrc
           cache: npm
       - run: npm clean-install
-      - run: npm audit signatures
-      - name: Ensure dependencies are compatible with the engines range
-        run: npx ls-engines
-      - run: npm run lint
-      # https://github.com/lirantal/lockfile-lint#readme
-      - name: Scan lockfile for security issues
-        run: npx lockfile-lint --path package-lock.json
+      - run: corepack npm audit signatures
+      - run: npm test
+
+  test:
+    runs-on: ubuntu-latest
+    needs:
+      - test_dev
+      - test_matrix
+    if: ${{ !cancelled() }}
+    steps:
       - name: All matrix versions passed
         if: ${{ !(contains(needs.*.result, 'failure')) }}
         run: exit 0