Disable install scripts

.github/workflows/api-docs.yml

@@ -23,7 +23,7 @@ jobs:
       - name: Setup Node
         uses: actions/setup-node@v7
         with:
-          node-version: "20"
+          node-version-file: ".nvmrc"
           cache: "npm"
       - name: Install dependencies
         run: npm ci

.github/workflows/ci.yml

@@ -24,7 +24,7 @@ jobs:
         with:
           node-version: ${{ matrix.node-version }}
           cache: "npm"
-      - run: npm ci --ignore-scripts
+      - run: npm ci
       # Unit tests are separate because running both at the same time causes issues
       # to the CI runner.
       - run: npm run test:unit:browser

.github/workflows/e2e-browser.yml

@@ -35,7 +35,7 @@ jobs:
           cache: "npm"
           cache-dependency-path: "**/package-lock.json"
       # install
-      - run: npm ci --ignore-scripts
+      - run: npm ci
       # build
       - run: npm run build
       # setup

.github/workflows/e2e-node.yml

@@ -33,7 +33,7 @@ jobs:
       - name: Install dependencies
         # FIXME: setup-node's caching seems to not restore correctly: https://github.com/actions/setup-node/pull/323/files
         # if: steps.setup-node.outputs.cache-hit != 'true'
-        run: npm ci --ignore-scripts
+        run: npm ci
 
       - # Dependabot cannot access secrets, so it doesn't have a token to authenticate to ESS.
         # We want jobs in this workflow to be gating PRs, so the whole matrix must

.github/workflows/release.yml

@@ -27,5 +27,6 @@ jobs:
       - run: npm install -g npm@latest
       - run: npm --version
       - run: npm ci
+      - run: npm run build
       - run: npm stage publish
       - run: echo "The package has been staged, go to https://www.npmjs.com to publish it."

.npmrc

@@ -0,0 +1,2 @@
+# Prevent supply chain attacks targetting install scripts.
+ignore-scripts=true

package.json

@@ -18,7 +18,6 @@
     "lint:check": "npm run lint:eslint",
     "lint:eslint": "eslint --config eslint.config.mjs .",
     "list-licenses": "license-checker --production --csv --out LICENSE_DEPENDENCIES_ALL",
-    "prepublishOnly": "npm run build",
     "test": "jest --ignoreProjects e2e-node",
     "test:unit:browser": "jest --selectProjects browser-utc",
     "test:unit:node": "jest --selectProjects node",