chore: bump @ckb-ccc/core to 1.14.0 to fix ws vulnerability (#436)

* chore: bump @ckb-ccc/core to 1.14.0 to fix ws vulnerability

Upgrades @ckb-ccc/core from 1.5.3 to 1.14.0 so the transitive
ws dependency resolves to ^8.21.0, which patches the reported
memory exhaustion DoS advisory.

* fix: add NervosDao to devnet known scripts for ccc 1.14.0 compatibility

ccc >= 1.14.0 calls getKnownScript(NervosDao) during completeFeeBy
for every input. Devnet has no NervosDao deployment, so supplying the
testnet definition lets isNervosDao() return false without throwing.

Also add the missing changeset for the @ckb-ccc/core bump.

Co-Authored-By: Claude <noreply@anthropic.com>

* ci: skip changeset PR comments on fork PRs

The github-script comment steps require pull-requests: write, which
fork PRs do not receive with the pull_request trigger. Skip the
optional comment steps on forks so the required changeset check can
still pass/fail cleanly.

Co-Authored-By: Claude <noreply@anthropic.com>

* fix: use actual devnet DAO script for NervosDao known script

The previous fallback reused the testnet NervosDao definition. Devnet
deploys its own DAO system cell, so map KnownScript.NervosDao to the
devnet dao script derived from ckb list-hashes instead.

Co-Authored-By: Claude <noreply@anthropic.com>

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: humble-little-bear

.changeset/bump-ccc-core-ws-fix.md

@@ -0,0 +1,5 @@
+---
+"@offckb/cli": patch
+---
+
+Bump @ckb-ccc/core to 1.14.0 to fix the ws vulnerability (ws >= 8.21.0).

.github/workflows/changeset-check.yml

@@ -44,7 +44,7 @@ jobs:
           fi
 
       - name: Comment on PR (success)
-        if: steps.check.outputs.has_changeset == 'true'
+        if: steps.check.outputs.has_changeset == 'true' && !github.event.pull_request.head.repo.fork
         uses: actions/github-script@v7
         with:
           script: |
@@ -68,7 +68,7 @@ jobs:
             }
 
       - name: Comment on PR (failure)
-        if: failure()
+        if: failure() && !github.event.pull_request.head.repo.fork
         uses: actions/github-script@v7
         with:
           script: |

package.json

@@ -78,7 +78,7 @@
     "typescript": "^5.3.3"
   },
   "dependencies": {
-    "@ckb-ccc/core": "1.5.3",
+    "@ckb-ccc/core": "1.14.0",
     "@iarna/toml": "^2.2.5",
     "@inquirer/prompts": "^7.8.6",
     "@types/http-proxy": "^1.17.15",