dc
8ed0f16004
The publish workflow installed cloudron-surfer, the mkdocs pip set and @marp-team/marp-cli with no version pins, so a breaking or compromised upstream release would ship straight to the live site on the next merge to main. - pin cloudron-surfer@6.4.1, mkdocs==1.6.1, mkdocs-material==9.7.7, fontawesome_markdown==0.2.6, mkdocs-redirects==1.2.3 and @marp-team/marp-cli@4.5.1 (the versions the site builds with today) - add .npmrc with ignore-scripts=true and save-exact=true; neither npm package ships an install/preinstall/postinstall hook, so nothing is skipped
12 lines
481 B
Plaintext
12 lines
481 B
Plaintext
# npm configuration for this repo's CI and local installs.
|
|
#
|
|
# ignore-scripts keeps package install scripts (an arbitrary-code execution
|
|
# point) from running during the deploy workflow. Both npm packages the
|
|
# workflow installs - cloudron-surfer and @marp-team/marp-cli - ship no
|
|
# install, preinstall or postinstall hook, so nothing is skipped.
|
|
#
|
|
# save-exact pins anything installed from here to an exact version rather than
|
|
# a caret range.
|
|
ignore-scripts=true
|
|
save-exact=true
|