ci: concurrency, cache, pinned actions, dependabot gha, .node-version (v0.1.8)

- Workflow: workflow_dispatch, cancel-in-progress, timeout, npm cache
- Pin actions/checkout + setup-node to SHAs; node-version-file
- Dependabot: github-actions weekly; commit-message prefixes
- .node-version + engines.node; validate .node-version; README layout
- Remove redundant README grep step (validate covers it)

Made-with: Cursor

Author: jesseoue

.cursor-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
 	"name": "leadmagic",
 	"displayName": "LeadMagic",
-	"version": "0.1.7",
+	"version": "0.1.8",
 	"description": "Official LeadMagic plugin for Cursor with hosted MCP (OAuth by default), skills, rules, agent, and commands: emails, mobile, LinkedIn-to-email, job changes, company research, competitors, technographics, and credits.",
 	"author": {
 		"name": "LeadMagic",

.github/dependabot.yml

@@ -7,3 +7,16 @@ updates:
     open-pull-requests-limit: 5
     labels:
       - dependencies
+    commit-message:
+      prefix: "chore(deps)"
+
+  - package-ecosystem: github-actions
+    directory: "/"
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+    labels:
+      - dependencies
+      - github-actions
+    commit-message:
+      prefix: "ci"

.github/workflows/validate-plugin.yml

@@ -9,6 +9,7 @@ on:
       - ".cursor-plugin/**"
       - ".github/**"
       - ".gitignore"
+      - ".node-version"
       - "assets/**"
       - "mcp.json"
       - "package.json"
@@ -24,25 +25,36 @@ on:
       - "skills/**"
       - "SECURITY.md"
       - "LICENSE"
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+defaults:
+  run:
+    shell: bash
 
 permissions:
   contents: read
 
 jobs:
   validate:
-    name: Validate package structure
+    name: Validate package
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     env:
       FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v5
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
 
       - name: Setup Node.js
-        uses: actions/setup-node@v5
+        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
         with:
-          node-version: "22"
+          node-version-file: ".node-version"
+          cache: npm
 
       - name: Install dependencies
         run: npm ci
@@ -52,7 +64,3 @@ jobs:
 
       - name: Validate plugin and hosted health
         run: npm run check
-
-      - name: Check README references
-        run: |
-          node -e "const fs=require('node:fs');const text=fs.readFileSync('README.md','utf8');for(const value of ['https://mcp.leadmagic.io/mcp','https://github.com/LeadMagic/leadmagic-openapi','https://cursor.com/docs/plugins','[SECURITY.md](SECURITY.md)','leadmagic://docs','LeadMagic MCP Tools','OAuth','[LICENSE](LICENSE)']){if(!text.includes(value)){throw new Error('README.md is missing required reference: '+value)}}"

.node-version

@@ -0,0 +1 @@
+22

CHANGELOG.md

@@ -2,6 +2,11 @@
 
 All notable changes to the LeadMagic Cursor plugin package are documented here.
 
+## 0.1.8
+
+- **CI/CD:** Concurrency to cancel superseded runs; job `timeout-minutes`; `workflow_dispatch`; npm cache via `actions/setup-node`; pin `actions/checkout` and `actions/setup-node` to full SHAs (`v5` tags); drop duplicate README string check (already enforced by `npm run validate`). Dependabot weekly updates for **GitHub Actions** plus npm commit-message prefixes.
+- **Tooling:** `.node-version` and `package.json` `engines` for Node 22+.
+
 ## 0.1.7
 
 - **Security:** Add [SECURITY.md](SECURITY.md); expand `.gitignore` for `.env*`; CI `permissions: contents: read`, `npm audit --audit-level=high`, and [Dependabot](.github/dependabot.yml) for npm.

README.md

@@ -71,6 +71,8 @@ For API-key mode (no OAuth), set `LEADMAGIC_API_KEY` where Cursor can read it an
 
 ## Developing this repository
 
+CI and local tooling target **Node.js 22** (see `.node-version` and `package.json` `engines`).
+
 ```bash
 npm ci
 npm run check
@@ -110,6 +112,7 @@ scripts/verify-mcp-health.mjs
 schemas/plugin.schema.json
 .github/workflows/validate-plugin.yml
 .github/dependabot.yml
+.node-version
 SECURITY.md
 LICENSE
 README.md

package.json

@@ -1,7 +1,10 @@
 {
 	"name": "leadmagic-cursor-plugin",
 	"private": true,
-	"version": "0.1.7",
+	"version": "0.1.8",
+	"engines": {
+		"node": ">=22"
+	},
 	"description": "Submission package for the LeadMagic Cursor plugin",
 	"license": "MIT",
 	"scripts": {

scripts/validate-plugin.mjs

@@ -113,6 +113,7 @@ try {
 		"Missing SECURITY.md (vulnerability disclosure and hardening)",
 	);
 	assert(exists("LICENSE"), "Missing LICENSE");
+	assert(exists(".node-version"), "Missing .node-version (CI / local Node alignment)");
 
 	assert(exists("mcp.json"), "Missing mcp.json");
 	const mcp = readJson("mcp.json");