From c93d7b2dc733fff77048695630c7d43eec2b009a Mon Sep 17 00:00:00 2001 From: "Nabheet S. Sandhu" Date: Sat, 31 Oct 2026 17:22:20 -0600 Subject: [PATCH] ci: do not run dependency install scripts in publish jobs MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The publish and prerelease jobs hold publishing credentials — `id-token: write` for trusted publishing (or the PAT on the extension) — and ran a plain `npm ci`, so every devDependency's install script executed with the ability to mint a publish token. Nothing in either job needs them: they build, then publish. `npm ci --ignore-scripts` on those two steps. Test and build jobs are unchanged and still install normally. Refs galactic-config#9. --- .github/workflows/ci.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 85ac9fc..d4295d0 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -226,7 +226,7 @@ jobs: node-version: 24 cache: npm registry-url: https://registry.npmjs.org/ - - run: npm ci + - run: npm ci --ignore-scripts if: steps.changes.outputs.changed == 'true' timeout-minutes: 2 - name: Determine channel (latest / beta) @@ -394,7 +394,7 @@ jobs: node-version: 24 cache: npm registry-url: https://registry.npmjs.org/ - - run: npm ci + - run: npm ci --ignore-scripts - name: Compute prerelease version id: version run: |