actions/ruff
1
0
Fork 0
mirror of https://github.com/astral-sh/ruff-action.git synced 2026-05-12 20:50:14 +02:00
Code Issues Packages Projects Releases Wiki Activity

chore: use npm ci --ignore-scripts in CI and scripts (#276)

Browse Source 
Replaces various uses of `npm install` with `npm ci --ignore-scripts`.
This should both be more hermetic (it'll always use the locked versions
rather than re-resolving) and will partially mitigate some build-time
code execution risk.

There should be no breakage risk, as the current dependency footprint is
small and shouldn't include anything that uses build scripts 🙂

Signed-off-by: William Woodruff <william@astral.sh>
This commit is contained in:
William Woodruff
2025-12-02 02:09:27 -05:00
committed by GitHub
parent 1e133b7ccc
commit 5960f93ec0
3 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/test.yml
+1 -1
View File
@@ -25,7 +25,7 @@ jobs:
with: with:
node-version: "20" node-version: "20"
- run: | - run: |
npm install npm ci --ignore-scripts
- run: | - run: |
npm run all npm run all
- name: Check all jobs are in all-tests-passed.needs - name: Check all jobs are in all-tests-passed.needs
.github/workflows/update-known-checksums.yml
+1 -1
View File
@@ -22,7 +22,7 @@ jobs:
run: run:
node dist/update-known-checksums/index.js node dist/update-known-checksums/index.js
src/download/checksum/known-checksums.ts ${{ secrets.GITHUB_TOKEN }} src/download/checksum/known-checksums.ts ${{ secrets.GITHUB_TOKEN }}
- run: npm install && npm run all - run: npm ci --ignore-scripts && npm run all
- name: Create Pull Request - name: Create Pull Request
uses: peter-evans/create-pull-request@84ae59a2cdc2258d6fa0732dd66352dddae2a412 # v7.0.9 uses: peter-evans/create-pull-request@84ae59a2cdc2258d6fa0732dd66352dddae2a412 # v7.0.9
with: with:
package.json
+1 -1
View File
@@ -10,7 +10,7 @@
"package": "ncc build -o dist/ruff-action src/ruff-action.ts && ncc build -o dist/update-known-checksums src/update-known-checksums.ts", "package": "ncc build -o dist/ruff-action src/ruff-action.ts && ncc build -o dist/update-known-checksums src/update-known-checksums.ts",
"act": "act pull_request -W .github/workflows/test.yml --container-architecture linux/amd64 -s GITHUB_TOKEN=\"$(gh auth token)\"", "act": "act pull_request -W .github/workflows/test.yml --container-architecture linux/amd64 -s GITHUB_TOKEN=\"$(gh auth token)\"",
"update-known-checksums": "RUNNER_TEMP=known_checksums node dist/update-known-checksums/index.js src/download/checksum/known-checksums.ts \"$(gh auth token)\"", "update-known-checksums": "RUNNER_TEMP=known_checksums node dist/update-known-checksums/index.js src/download/checksum/known-checksums.ts \"$(gh auth token)\"",
"all": "npm install && npm run build && npm run check && npm run package" "all": "npm ci --ignore-scripts && npm run build && npm run check && npm run package"
}, },
"repository": { "repository": {
"type": "git", "type": "git",