From d49486184a2b422f64cd70489a18275ff9a73f14 Mon Sep 17 00:00:00 2001 From: Koji Wakayama Date: Sat, 7 Nov 2026 09:54:50 +0100 Subject: [PATCH] ci: install the pinned npm CLI with --ignore-scripts SonarQube rule S6505 flags the two publication jobs' global npm install for running lifecycle scripts, which drops main's new-code security rating to C and fails the quality gate on every push. The npm package needs no install scripts. --- .github/workflows/cicd.yml | 4 ++-- tests/integration/ci/registry-release-workflow.test.ts | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/cicd.yml b/.github/workflows/cicd.yml index 32e39859bc..35f5a3c2ee 100644 --- a/.github/workflows/cicd.yml +++ b/.github/workflows/cicd.yml @@ -1664,7 +1664,7 @@ jobs: - name: Pin npm CLI for publication env: NPM_CLI_VERSION: "11.12.1" - run: npm install --global "npm@${NPM_CLI_VERSION}" + run: npm install --global --ignore-scripts "npm@${NPM_CLI_VERSION}" - name: Compute RC version id: version @@ -1887,7 +1887,7 @@ jobs: - name: Pin npm CLI for publication env: NPM_CLI_VERSION: "11.12.1" - run: npm install --global "npm@${NPM_CLI_VERSION}" + run: npm install --global --ignore-scripts "npm@${NPM_CLI_VERSION}" - name: Download tested npm compatibility artifact uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 diff --git a/tests/integration/ci/registry-release-workflow.test.ts b/tests/integration/ci/registry-release-workflow.test.ts index ce1fda784c..70b0780e51 100644 --- a/tests/integration/ci/registry-release-workflow.test.ts +++ b/tests/integration/ci/registry-release-workflow.test.ts @@ -856,7 +856,7 @@ printf '%064d %s\n' 0 "$1" ); assertEquals( npmPinStep.run, - 'npm install --global "npm@${NPM_CLI_VERSION}"', + 'npm install --global --ignore-scripts "npm@${NPM_CLI_VERSION}"', ); assert( jobSteps.indexOf(npmPinStep) < jobSteps.indexOf(publishStep),