ci: ignore scripts on pnpm install to avoid security exposure

invoke-ai · Jan 26, 2024 · 0bdfc2f · 0bdfc2f
1 parent ed74363
commit 0bdfc2f
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/.github/workflows/npm-publish.yml b/.github/workflows/npm-publish.yml
@@ -39,7 +39,7 @@ jobs:
           run_install: false
 
       - name: Install dependencies
-        run: pnpm install --frozen-lockfile
+        run: pnpm install --frozen-lockfile --ignore-scripts
         env:
           # NODE_AUTH_TOKEN: ${{ matrix.registry.token }}
           NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}