From 170e0c7bbae03ebb43fcd444e1eb27528a0e7c49 Mon Sep 17 00:00:00 2001 From: John McLear Date: Fri, 17 Apr 2026 09:04:01 +0100 Subject: [PATCH] fix: demote ERR_PNPM_IGNORED_BUILDS to warning in publish step Set npm_config_strict_dep_builds=false as a job-level env var so pnpm doesn't fail the release job when a transitive dep (e.g. unrs-resolver@1.11.1 via eslint-config-etherpad) has a postinstall script that isn't in any allowlist. Co-Authored-By: Claude Opus 4.6 (1M context) --- .github/workflows/npmpublish.yml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/.github/workflows/npmpublish.yml b/.github/workflows/npmpublish.yml index 34544a9..28686bf 100644 --- a/.github/workflows/npmpublish.yml +++ b/.github/workflows/npmpublish.yml @@ -17,6 +17,11 @@ jobs: permissions: contents: write # for the atomic version-bump push (branch + tag) id-token: write # for npm OIDC trusted publishing + env: + # pnpm 10.7+ treats ignored postinstalls as hard errors. Demote + # to warning so new transitive deps (e.g. unrs-resolver) don\'t break + # the release step. + npm_config_strict_dep_builds: "false" steps: - uses: actions/setup-node@v6 with: