From 391b23ecee0518bb2fbbc4c99a9b3be52910d0d6 Mon Sep 17 00:00:00 2001 From: "Nabheet S. Sandhu" Date: Sat, 31 Oct 2026 17:22:22 -0600 Subject: [PATCH] ci: do not run dependency install scripts in publish jobs MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The publish and prerelease jobs hold publishing credentials — `id-token: write` for trusted publishing (or the PAT on the extension) — and ran a plain `npm ci`, so every devDependency's install script executed with the ability to mint a publish token. Nothing in either job needs them: they build, then publish. `npm ci --ignore-scripts` on those two steps. Test and build jobs are unchanged and still install normally. Refs galactic-config#9. --- .github/workflows/ci.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 0cac699..4760d1f 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -226,7 +226,7 @@ jobs: node-version: 24 cache: npm registry-url: https://registry.npmjs.org/ - - run: npm ci + - run: npm ci --ignore-scripts if: steps.changes.outputs.changed == 'true' timeout-minutes: 2 - name: Determine channel (latest / beta) @@ -393,7 +393,7 @@ jobs: node-version: 24 cache: npm registry-url: https://registry.npmjs.org/ - - run: npm ci + - run: npm ci --ignore-scripts - name: Compute prerelease version id: version run: |