chore: various initial setup

[OrKoN]

No description provided.

[mathiasbynens]

wolflows 🤔

[OrKoN]

Fixed 😂

[mathiasbynens]

What’s the rationale for including package-log.json? If we’re gonna do this we should add an .npmrc with package-lock=true in it, so that it’s still updated even on systems where the global .npmrc disables it.

[mathiasbynens]

LGTM % question

[OrKoN]

That is a recommendation from ossf/scorecard-action for pinned-dependencies:

If the package manager supports lock files (e.g. package-lock.json for npm), make sure to check these in the source code as well. These files maintain signatures for the entire dependency tree and saves from future exploitation in case the package is compromised.

Also, NPM recommends checking it in. I will add an .npmrc.