From 1f30a84c67ded0dbc9e94c214f47aae1087f87b4 Mon Sep 17 00:00:00 2001
From: zaniebot <zaniebot@accounts.zanie.blue>
Date: Tue, 18 Aug 2026 12:12:36 -0500
Subject: [PATCH] Harden npm install defaults (#401)

CI already disables npm lifecycle scripts, but ordinary installs from
the repository still run them. Add `.npmrc` defaults that disable those
scripts and apply the same seven-day `min-release-age` policy used by
`setup-uv`. Require npm `11.10.0` or newer through `devEngines` so older
versions cannot silently ignore the age setting. Explicit project
commands such as `npm run package` remain available.

Co-authored-by: zaniebot <242828183+zaniebot@users.noreply.github.com>
---
 .npmrc       | 2 ++
 package.json | 7 +++++++
 2 files changed, 9 insertions(+)
 create mode 100644 .npmrc

diff --git a/.npmrc b/.npmrc
new file mode 100644
index 0000000..c2ec5e6
--- /dev/null
+++ b/.npmrc
@@ -0,0 +1,2 @@
+ignore-scripts = true
+min-release-age = 7
diff --git a/package.json b/package.json
index be00305..9acfbdc 100644
--- a/package.json
+++ b/package.json
@@ -5,6 +5,13 @@
   "type": "module",
   "description": "A GitHub Action to run Ruff, an extremely fast Python linter and code formatter.",
   "main": "dist/ruff-action/index.cjs",
+  "devEngines": {
+    "packageManager": {
+      "name": "npm",
+      "version": ">=11.10.0",
+      "onFail": "error"
+    }
+  },
   "scripts": {
     "build": "tsc --noEmit",
     "check": "biome check --write",