From 923755e23faa1ca9af1b09a01299996d77c58bd4 Mon Sep 17 00:00:00 2001 From: achoimet <12182686+achoimet@users.noreply.github.com> Date: Tue, 11 Aug 2026 14:09:30 +0200 Subject: [PATCH] ci: add --ignore-scripts to npm tool installs (Sonar) --- .github/workflows/reusable-extension-ci.yml | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/.github/workflows/reusable-extension-ci.yml b/.github/workflows/reusable-extension-ci.yml index 13f7832..7bb61bc 100644 --- a/.github/workflows/reusable-extension-ci.yml +++ b/.github/workflows/reusable-extension-ci.yml @@ -144,11 +144,11 @@ jobs: env: SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }} # Version pinned for reproducibility (this runs at release time, so avoid a surprise major bump). - # Note: --allow-scripts=snyk (npm 12 blocks install scripts by default) because snyk's postinstall - # bootstraps its CLI binary; without it the binary is lazily downloaded on first run instead. + # Note: --ignore-scripts satisfies Sonar and npm 12 script blocking; snyk then lazily downloads + # its CLI binary on first run instead of in a postinstall (verified working). run: | - npm install -g npm@12.0.2 - npm install -g --allow-scripts=snyk snyk@1.1306.1 + npm install -g --ignore-scripts npm@12.0.2 + npm install -g --ignore-scripts snyk@1.1306.1 snyk test --org=${{ vars.SNYK_ORG_ID }} --severity-threshold=high --project-name=${{ github.repository }} --target-reference=${{ github.ref_name }} - name: Download e2e coverage files @@ -443,7 +443,7 @@ jobs: # this commit will effectively cause another run of the workflow which then actually performs the helm chart release - run: | - npm install -g npm@12.0.2 + npm install -g --ignore-scripts npm@12.0.2 npm install --ignore-scripts -g semver@7.8.1 make chart-bump-version APP_VERSION="${{ needs.build-images.outputs.version }}" git config user.name "$GITHUB_ACTOR"