Disable package install scripts in publish workflow (code scanning S6505)

[404-Page-Found]

Summary

Code scanning (rule githubactions:S6505) flags 3 occurrences of npm ci in .github/workflows/publish.yml, which executes lifecycle scripts (preinstall/postinstall/prepare) from dependencies during installation. If a dependency ships a malicious install script, it runs with the workflow's token/credentials.

Alerts:

• publish.yml:23 — publish-npm job
• publish.yml:44 — publish-github job
• publish.yml:76 — binaries job

Expected behavior

Dependencies install without executing arbitrary lifecycle scripts.

Actual behavior

npm ci runs dependency lifecycle scripts during installation in all three publish jobs.

Suggested fix

• Install with npm ci --ignore-scripts if no dependency genuinely needs install-time scripts (this project's builds are pure TypeScript via npm run build, so scripts are not required at install time).
• If some dependency requires a build script, allow-list specific packages instead of running all scripts.
• The binaries job also runs npx @yao-pkg/pkg@latest — consider pinning that version too (out of scope here but related).

Environment

• Workflow: .github/workflows/publish.yml (jobs: publish-npm, publish-github, binaries)

Additional context

Source: GitHub code scanning alerts #3, #4, #5. Severity: medium.