Chore: [AEA-0000] - add ignore-scripts to npm ci#736
Conversation
|
There was a problem hiding this comment.
Pull request overview
Updates the repository’s Node installation step to disable running npm lifecycle scripts during npm ci, aligning installs with a more locked-down/supply-chain-conscious posture.
Changes:
- Add
--ignore-scriptsto theinstall-nodeMakefile target’snpm cicommand.
|
|
||
| install-node: | ||
| npm ci | ||
| npm ci --ignore-scripts |
There was a problem hiding this comment.
npm ci --ignore-scripts will skip all dependency lifecycle scripts. In the current package-lock.json there are dependencies marked hasInstallScript (e.g., unrs-resolver used by jest-resolve), so this change can alter runtime behavior and potentially break npm run test/npm run lint if any required postinstall step is skipped. Consider restricting --ignore-scripts to CI-only (or adding a separate make target) and/or explicitly verifying in CI that build/lint/test still pass after a clean install with scripts disabled.
| npm ci --ignore-scripts | |
| npm ci |
|



Summary
Details