3 Commits
Author SHA1 Message Date
securityeng-bot[bot] 30f4b7f6a6 fix: replace npm install with npm ci (20260615-141322) (#762)
CodeQL / Analyze (go) (push) Failing after 45s
CodeQL / Analyze (python) (push) Failing after 28s
CodeQL / Analyze (typescript) (push) Failing after 26s
fix: use lockfile-aware install commands

Co-authored-by: securityeng-bot[bot] <219863240+securityeng-bot[bot]@users.noreply.github.com>
2026-06-15 11:55:18 -04:00
securityeng-bot[bot] 8ded149643 ci: add ignore-scripts to Node package manager config (20260527-153132)
CodeQL / Analyze (go) (push) Failing after 31s
CodeQL / Analyze (python) (push) Failing after 27s
CodeQL / Analyze (typescript) (push) Failing after 27s
Adds ignore-scripts=true (.npmrc) and enableScripts: false (.yarnrc.yml) to all Node.js Dockerfiles to prevent supply-chain attacks via postinstall scripts.
2026-06-05 09:23:18 -04:00
securityeng-bot[bot] 662dfc07d1 ci: add ignore-scripts to Node package manager config (20260526-184008) (#748)
* ci: enforce ignore-scripts policy for Node package managers

---------

Co-authored-by: securityeng-bot[bot] <219863240+securityeng-bot[bot]@users.noreply.github.com>
2026-06-05 09:05:39 -04:00