actions/setup-uv
5
0
Fork 0
mirror of https://github.com/astral-sh/setup-uv.git synced 2025-12-23 11:01:03 +00:00
Code Activity

chore: use npm ci --ignore-scripts everywhere (#699)

Browse Source 
Like https://github.com/astral-sh/ruff-action/pull/276 🙂 

This also adds cooldown stanzas to the Dependabot updater rules: this
ensures that we only receive dependency bumps once they're at least a
week old, which should reduce the window of opportunity for an attacker
who temporarily compromises popular packages (like with "Shai-Hulud"
last week).

Signed-off-by: William Woodruff <william@astral.sh>
This commit is contained in:
William Woodruff
2025-12-02 02:08:49 -05:00
committed by GitHub
parent 5ae467fbf9
commit 64f7f4e15f
4 changed files with 8 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
.github/workflows/update-known-versions.yml vendored
View File

@@ -39,7 +39,7 @@ jobs:
fi
- name: Compile changes
if: ${{ steps.changes-exist.outputs.changes-exist == 'true' }}
run: npm ci && npm run all
run: npm ci --ignore-scripts && npm run all
- name: Commit and push changes
if: ${{ steps.changes-exist.outputs.changes-exist == 'true' }}
id: commit-and-push