Harden npm install defaults (#401)

mirror of https://github.com/astral-sh/ruff-action.git synced 2026-09-21 11:11:30 +00:00

CI already disables npm lifecycle scripts, but ordinary installs from
the repository still run them. Add `.npmrc` defaults that disable those
scripts and apply the same seven-day `min-release-age` policy used by
`setup-uv`. Require npm `11.10.0` or newer through `devEngines` so older
versions cannot silently ignore the age setting. Explicit project
commands such as `npm run package` remain available.

Co-authored-by: zaniebot <242828183+zaniebot@users.noreply.github.com>

This commit is contained in:

zaniebot

2026-08-18 19:12:36 +02:00

committed by

GitHub

co-authored by

zaniebot

parent d3ef2489b0

commit 1f30a84c67

2 changed files with 9 additions and 0 deletions

.npmrc

View File

@@ -0,0 +1,2 @@
 ignore-scripts = true
 min-release-age = 7