From 32909616a392f87a68940854e3323ae73da150d9 Mon Sep 17 00:00:00 2001 From: Ned Wolpert Date: Thu, 11 Jun 2026 07:29:31 -0700 Subject: [PATCH] ci: harden npm steps against script execution and unpinned fetches Address SonarQube findings on the browser SDK CI job: - npm ci --ignore-scripts (S6505): skip lifecycle scripts during install - npm exec --no-install (S6505/S8543): run the locked local Stryker dep instead of letting npx fetch an unpinned version Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/ci.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 09d59a2..ec7e8f4 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -57,11 +57,11 @@ jobs: node-version: '20' - name: Install dependencies - run: npm ci + run: npm ci --ignore-scripts working-directory: clients/passkeys-browser - name: Run Stryker mutation tests - run: npx stryker run + run: npm exec --no-install -- stryker run working-directory: clients/passkeys-browser env: STRYKER_DASHBOARD_API_KEY: ${{ secrets.STRYKER_DASHBOARD_TOKEN }}