build: add min release age step

[tomdavies73]

Proposed behaviour

Adds a build step which will alert us if any packages do not meet our minimum release age. This is particularly useful for dependabot raised PRs as there is currently no way to get dependabot to respect our minumum release age.

This prevents us from accidentially adding recently published packages which are comporomised via dependabot.

Here's a link to a run that shows the new check succesully failing on a recently published package

Here's a link to a run that shows the new check sucessfully failing after the above package met maturity guidelines

Current behaviour

Currently dependabot does not adhere to our minimum release age during security alerts, therefore if we do not verify the package maturity we could accept package updates which are not aligned with our maturity guidelines.

Checklist

• Commits follow our style guide
• Related issues linked in commit messages if required
• Screenshots are included in the PR if useful
• All themes are supported if required
• Unit tests added or updated if required
• Playwright automation tests added or updated if required
• Storybook added or updated if required
• Translations added or updated (including creating or amending translation keys table in storybook) if required
• Typescript d.ts file added or updated if required
• Related docs have been updated if required

QA

• Tested in provided StackBlitz sandbox/Storybook
• Add new Playwright test coverage if required
• Carbon implementation matches Design System/designs
• UI Tests GitHub check reviewed if required

Additional context

Testing instructions

[Copilot]

🟡 Changes recommended

The threshold unit is incorrect, and dependency code can execute in parallel jobs before validation.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Adds CI enforcement for minimum npm package release age.

Changes:

• Adds concurrent registry checks for locked package versions.
• Exposes the checker through npm.
• Runs the check before the build job installs dependencies.

File summaries

File	Description
scripts/check-release-age.mjs	Implements release-age validation.
package.json	Adds the validation command.
.github/workflows/ci.yml	Integrates validation into CI.

Review details

• Files reviewed: 3/3 changed files
• Comments generated: 3
• Review effort level: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[tomdavies73]

I'm not sure there is a real risk here, our checks are ran in an isolated enviroment so its not the end of the world if we do an npm install elsewhere here.

I think all that really matters is that we throw an exit code 1 and the build fails so we can't merge the PR 👍

[tomdavies73]

min-release-age=3 will be counted as 3 days, not sure where its getting 3 seconds from. What we have here works as expected