chore: skip TLS verification for the Mattermost webhook

[lskramarov]

No description provided.

[github-actions]

Visit the preview URL for this PR (updated for commit 8b6ea7c):

https://koobiq-next--prs-1878-djc2a2gg.web.app

_{(expires Fri, 14 Aug 2026 07:01:02 GMT)}

_{🔥 via Firebase Hosting GitHub Action 🌎}

_{Sign: c9e37e518febda70d0317d07e8ceb35ac43c534c}

[Copilot]

Pull request overview

This PR updates the release/PR Mattermost notification paths to handle an internal webhook endpoint with an untrusted TLS chain, while also tightening CI security posture and improving test robustness in core formatters.

Changes:

• Add an opt-in MATTERMOST_ALLOW_UNTRUSTED_TLS switch to disable TLS verification for the CLI’s Mattermost webhook request only.
• Add property-based tests (fast-check) for number and filesize formatters to validate invariants across broad input ranges.
• Harden CI configuration: least-privilege workflow permissions, reproducibility tweaks in the e2e Docker image, and a new scheduled CodeQL workflow.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
packages/cli/src/release/notify-release.ts	Adds an env-controlled TLS verification bypass (rejectUnauthorized) for the Mattermost webhook request.
.github/workflows/publish.yml	Uses MATTERMOST_ALLOW_UNTRUSTED_TLS (scoped to the CLI notification) and moves write permissions to the job level.
.github/workflows/pr-notify.yml	Disables TLS verification for webhook notification job via NODE_TLS_REJECT_UNAUTHORIZED.
packages/components/core/formatters/number/formatter.spec.ts	Adds fast-check property tests for KbqDecimalPipe digitsInfo parsing/behavior.
packages/components/core/formatters/filesize/formatter.spec.ts	Adds fast-check property tests for getHumanizedBytes invariants.
package.json	Adds fast-check dev dependency; adds/updates resolutions for js-yaml and nanoid.
yarn.lock	Lockfile updates for fast-check/pure-rand and bumped resolutions (js-yaml, nanoid).
.yarnrc.yml	Adds npm audit advisory ignores for image-size DoS advisories (no patched upstream).
tools/e2e/Dockerfile	Pins global n version to keep the e2e image build reproducible.
.github/workflows/redeploy-preview.yml	Moves write permissions to the job level; keeps default permissions read-only.
.github/workflows/e2e.yml	Sets read-only default permissions (jobs override as needed).
.github/workflows/e2e-approve-snapshots.yml	Moves write permissions to the job level; keeps default permissions read-only.
.github/workflows/docs-stable.yml	Moves checks: write to the job level; keeps default permissions read-only.
.github/workflows/deploy-preview.yml	Moves write permissions to the job level; keeps default permissions read-only.
.github/workflows/codeql.yml	Adds a scheduled + PR CodeQL workflow with minimal permissions and no-build mode.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.