Merge pull request #292 from docker/sec-cli/ignore-scripts-fix-20260527-193437

ci: add ignore-scripts to Node package manager config (20260527-193437)
ci: enforce ignore-scripts policy for Node package managers
2026-05-28 09:08:18 +01:00 · 2026-05-28 10:01:41 +02:00 · 2026-05-27 20:05:13 +00:00
5 changed files with 84 additions and 83 deletions
--- a/.yarnrc.yml
+++ b/.yarnrc.yml
@@ -17,3 +17,4 @@ logFilters:
 nodeLinker: node-modules

 npmAuthToken: "${NODE_AUTH_TOKEN:-fallback}"
+enableScripts: false
--- a/dist/index.cjs
+++ b/dist/index.cjs
--- a/dist/index.cjs.map
+++ b/dist/index.cjs.map
--- a/package.json
+++ b/package.json
@@ -23,7 +23,7 @@
  "license": "Apache-2.0",
  "packageManager": "yarn@4.9.2",
  "dependencies": {
-    "@actions/core": "^3.0.1",
+    "@actions/core": "^3.0.0",
    "@docker/actions-toolkit": "^0.91.0"
  },
  "devDependencies": {
--- a/yarn.lock
+++ b/yarn.lock
@@ -2822,7 +2822,7 @@ __metadata:
  version: 0.0.0-use.local
  resolution: "docker-setup-qemu@workspace:."
  dependencies:
-    "@actions/core": "npm:^3.0.1"
+    "@actions/core": "npm:^3.0.0"
    "@docker/actions-toolkit": "npm:^0.91.0"
    "@eslint/js": "npm:^9.39.3"
    "@types/node": "npm:^24.11.0"
Author	SHA1	Message	Date
CrazyMax	db6b4cfde3	Merge pull request #292 from docker/sec-cli/ignore-scripts-fix-20260527-193437 ci: add ignore-scripts to Node package manager config (20260527-193437)	2026-05-28 10:01:41 +02:00
securityeng-bot[bot]	8864a83d99	ci: enforce ignore-scripts policy for Node package managers	2026-05-27 20:05:13 +00:00