👷‍♀️ Use GITHUB_TOKEN for install

reedsy · Jan 18, 2024 · 4e7cf41 · 4e7cf41
1 parent b0df39e
commit 4e7cf41
Showing 1 changed file with 6 additions and 1 deletion.
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -34,7 +34,12 @@ jobs:
         node-version: '20.x'
         registry-url: 'https://npm.pkg.github.com'
     - name: Install
-      run: npm install
+      # Skip post-install to avoid malicious scripts stealing PAT
+      run: npm install --ignore-script
+      env:
+        NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+    - name: Post-install
+      run: npm rebuild && npm run prepare --if-present
     - name: Lint
       run: npm run lint
     - name: Test