From 8ccb885906bd8dbabf2aeec6efc15de4debd4fe5 Mon Sep 17 00:00:00 2001
From: kingchenc <kingchencp@gmail.com>
Date: Fri, 22 May 2026 12:32:23 +0200
Subject: [PATCH] D4: pass --ignore-scripts to per-platform npm publish/pack

The main npm package already publishes and packs with --ignore-scripts,
but the per-platform subpackage loop did not: `npm publish --access
public`, its retry, and the per-platform `npm pack` all ran lifecycle
scripts from the package directory with the npm token in scope.

Add --ignore-scripts to all three, matching the main package, so no
prepublish/prepare hook can execute during a release.
---
 .github/workflows/release.yml | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 3774762c..f9deb48e 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -232,13 +232,17 @@ jobs:
               return 0
             fi
             echo "::group::publish $pkgname@$version"
-            (cd "$dir" && npm publish --access public)
+            # --ignore-scripts: a per-platform package must never run lifecycle
+            # scripts during publish (npm runs prepublishOnly/prepare/etc. from
+            # the package being published — a malicious or stray script would
+            # execute with the npm token in the environment).
+            (cd "$dir" && npm publish --access public --ignore-scripts)
             local rc=$?
             echo "::endgroup::"
             if [ "$rc" -ne 0 ]; then
               echo "::warning::first attempt of $pkgname failed (rc=$rc); retrying after 30s"
               sleep 30
-              (cd "$dir" && npm publish --access public)
+              (cd "$dir" && npm publish --access public --ignore-scripts)
               rc=$?
             fi
             if [ "$rc" -ne 0 ]; then
@@ -284,9 +288,11 @@ jobs:
         run: |
           # Main package
           npm pack --ignore-scripts
-          # Each per-platform package (the binaries were already moved in by napi artifacts)
+          # Each per-platform package (the binaries were already moved in by
+          # napi artifacts). --ignore-scripts for the same reason as publish:
+          # packing must not execute lifecycle scripts from the packed dir.
           for d in npm/*/; do
-            (cd "$d" && npm pack)
+            (cd "$d" && npm pack --ignore-scripts)
           done
 
       - name: Upload Node tarballs