From 2c3bf5b643e2cda16c3219dbaf58554b73ae6b29 Mon Sep 17 00:00:00 2001 From: Peter Somogyvari Date: Tue, 18 Jun 2024 09:53:39 -0700 Subject: [PATCH] ci(github): add --ignore-scripts to lerna publish - some are failing 1. Longer term we'll just fix the scripts that are crashing, but right now as a short term solution I disabled the script execution. 2. It might even be more secure for us to use this ignore scripts flag permanently because some of the attack vectors are in those scripts which new versions of the dependencies can execute arbitrary code. Signed-off-by: Peter Somogyvari --- .github/workflows/all-nodejs-packages-publish.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/all-nodejs-packages-publish.yaml b/.github/workflows/all-nodejs-packages-publish.yaml index 1f73d7e8c3..44cdab814b 100644 --- a/.github/workflows/all-nodejs-packages-publish.yaml +++ b/.github/workflows/all-nodejs-packages-publish.yaml @@ -40,4 +40,4 @@ jobs: git config --global user.email "npm-ci@hyperledger.org" git config --global user.name "hyperledger-ghci" npm whoami - yarn lerna publish from-git --yes --loglevel=debug + yarn lerna publish from-git --yes --loglevel=debug --ignore-scripts