Adopt @lavamoat/allow-scripts to gate npm install scripts

Disables dependency lifecycle scripts by default via .npmrc (ignore-scripts=true) so arbitrary packages cannot execute code at install time. An explicit allowlist in web/package.json opts specific packages back in, and CI/Docker/Taskfile now run allow-scripts after npm install to apply it. Co-Authored-By: Claude Opus 4.7 <[email protected]>
2026-04-17 11:29:08 -03:00
parent 0446e8f8a7
commit 668397104a
6 changed files with 1295 additions and 4 deletions
@@ -36,7 +36,7 @@ jobs:

      - name: Install dependencies
        working-directory: web
-        run: npm install
+        run: npm install && npm exec -- allow-scripts

      - name: Type check
        working-directory: web