Skip to content

migrate node-remediation-console-plugin to npm #79375

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
openshift-merge-bot merged 1 commit into from
May 18, 2026
Merged

migrate node-remediation-console-plugin to npm #79375

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion ...erator/config/medik8s/node-remediation-console/medik8s-node-remediation-console-main.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,7 @@ resources:
memory: 200Mi
tests:
- as: lint
commands: yarn install --ignore-scripts && yarn run lint
commands: npm ci && npm run lint
Copy link
Copy Markdown
Contributor

@coderabbitai coderabbitai Bot May 17, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🌐 Web query:

Does npm cirun lifecycle scripts by default, and is--ignore-scriptsthe npm equivalent of Yarn v1install --ignore-scripts?

💡 Result:

Yes, npm ci runs lifecycle scripts by default [1]. These include scripts such as preinstall, install, and postinstall, which are executed after the dependencies are installed into node_modules [1]. Yes, --ignore-scripts is the npm equivalent of Yarn v1's install --ignore-scripts [2][3]. When the --ignore-scripts flag is passed to npm ci, it prevents the execution of these lifecycle scripts [2][4]. This is a common security practice in automated environments to avoid running untrusted code during the installation process [3][5]. Note that while --ignore-scripts prevents automatic execution of lifecycle scripts, it does not prevent the execution of scripts explicitly called via commands like npm run-script [6][4].

Citations:

Preserve previous --ignore-scripts install behavior for lint CI.

Line 23 changes semantics: npm ci runs lifecycle scripts by default, while the prior Yarn command explicitly suppressed them. This introduces unnecessary supply-chain/script-execution risk in a lint-only job.

Suggested change 
-  commands: npm ci && npm run lint
+  commands: npm ci --ignore-scripts && npm run lint
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
commands: npm ci && npm run lint
commands: npm ci --ignore-scripts && npm run lint
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In
`@ci-operator/config/medik8s/node-remediation-console/medik8s-node-remediation-console-main.yaml`
at line 23, The change replaces a Yarn install that previously suppressed
lifecycle scripts with plain `npm ci`, which runs scripts by default; update the
`commands` entry so the install step preserves the prior --ignore-scripts
behavior (i.e., run npm ci with --ignore-scripts) before running the lint step,
keeping the sequence in the `commands` key (refer to the existing commands
line).

container:
from: src
skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$
Expand Down