Disable install scripts

.github/workflows/api-docs.yml

@@ -23,7 +23,7 @@ jobs:
       - name: Setup Node
         uses: actions/setup-node@v7
         with:
-          node-version: "20"
+          node-version-file: ".nvmrc"
           cache: "npm"
       - name: Install dependencies
         run: npm ci

.github/workflows/e2e-browser.yml

@@ -26,12 +26,9 @@ jobs:
           node-version-file: ".nvmrc"
           cache: "npm"
           cache-dependency-path: "**/package-lock.json"
-      # install
-      - run: npm ci --ignore-scripts
+      - run: npm ci
       - run: npx playwright install --with-deps
-      # build
       - run: npm run build
-      # test
       - # Dependabot cannot access secrets, so it doesn't have a token to authenticate to ESS.
         # We want jobs in this workflow to be gating PRs, so the whole matrix must
         # run even for dependabot so that the matrixed jobs are skipped, instead

.github/workflows/release.yml

@@ -26,5 +26,6 @@ jobs:
       # Ensure npm 11.5.1 or later for trusted publishing
       - run: npm install -g npm@latest
       - run: npm ci
+      - run: npm run build
       - run: npm stage publish
       - run: echo "The package has been staged, go to https://www.npmjs.com to publish it."

.npmrc

@@ -0,0 +1,2 @@
+# Prevent supply chain attacks targetting install scripts.
+ignore-scripts=true

package.json

@@ -16,7 +16,6 @@
     "lint:fix": "npm run lint:eslint -- --fix",
     "lint:check": "npm run lint:eslint",
     "lint:eslint": "eslint --config eslint.config.mjs .",
-    "prepublishOnly": "npm run build",
     "test": "jest --ignoreProjects e2e-node --passWithNoTests",
     "test:unit:browser": "jest --selectProjects browser",
     "test:unit:node": "jest --selectProjects node",