Skip to content

Fix typo: replace --ignore-script with --ignore-scripts in CI #21

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
alecgibson merged 1 commit into from
Apr 2, 2026
Merged

Fix typo: replace --ignore-script with --ignore-scripts in CI #21

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,7 +33,7 @@ jobs:
registry-url: 'https://npm.pkg.github.com'
- name: Install
# Skip post-install to avoid malicious scripts stealing PAT
Copy link

Copilot AI Apr 2, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The comment about skipping post-install scripts to avoid stealing a "PAT" is a bit misleading/inaccurate: this step sets NODE_AUTH_TOKEN from secrets.GITHUB_TOKEN (not a PAT), and lifecycle scripts are later re-enabled via the npm rebuild && npm run prepare step. Consider updating the comment to clarify that scripts are skipped only during the authenticated install step (and that the credential is GITHUB_TOKEN/auth token).

Suggested change
# Skip post-install to avoid malicious scripts stealing PAT
# During authenticated install, skip lifecycle scripts to reduce risk of
# malicious scripts exfiltrating the GITHUB_TOKEN auth token; scripts are
# re-enabled in the post-install step below.

Copilot uses AI. Check for mistakes.
run: npm install --ignore-script
run: npm install --ignore-scripts
env:
NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
- name: Post-install
Expand Down
Loading