-
Notifications
You must be signed in to change notification settings - Fork 0
/
action.yml
35 lines (34 loc) · 1.18 KB
/
action.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
name: safe Install NPM Packages
description: Install Packages from a private NPM registry without running the risk of malicious packages stealing your NPM-token
# see https://github.com/actions/setup-node/blob/main/docs/advanced-usage.md#publish-to-npmjs-and-gpr-with-npm
inputs:
NPM_TOKEN:
description: 'NPM Token for Repo'
required: true
registry-url:
description: Url of npm registry
default: 'https://registry.npmjs.org'
required: false
node-version:
description: Version of node to use
default: '20'
required: false
runs:
using: composite
steps:
- name: Setup node environment with private repo
uses: actions/setup-node@v4
with:
node-version: ${{ inputs.node-version }}
registry-url: ${{ inputs.registry-url }}
- name: Install NPM Packages
shell: bash
# Skip post-install scripts here, as a malicious script could steal NPM_TOKEN
run: npm ci --ignore-scripts
env:
NODE_AUTH_TOKEN: ${{ inputs.NPM_TOKEN }}
NPM_TOKEN: ${{ inputs.NPM_TOKEN }}
- name: Install Scripts
shell: bash
# `npm rebuild` will run all those post-install scripts for us.
run: npm rebuild && npm run prepare --if-present