👷‍♀️ Use GITHUB_TOKEN for installing

reedsy · Jan 18, 2024 · a388259 · a388259
1 parent 2767c2e
commit a388259
Showing 1 changed file with 6 additions and 1 deletion.
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -19,7 +19,12 @@ jobs:
         node-version: '20.x'
         registry-url: 'https://npm.pkg.github.com'
     - name: Install
-      run: npm install
+      # Skip post-install to avoid malicious scripts stealing PAT
+      run: npm install --ignore-script
+      env:
+        NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+    - name: Post-install
+      run: npm rebuild && npm run prepare --if-present
     - name: Test
       run: npm test --forbid-only
     - name: Release