Harden publish dependency installation

[9larsons]

What changed

• disable dependency lifecycle scripts during the frozen Yarn install in the npm publish job
• keep the existing OIDC trusted-publishing and provenance configuration unchanged

Why

The publish job has id-token write permission, so allowing arbitrary dependency lifecycle scripts during installation gives compromised transitive dependencies code execution in a privileged release context. Yarn's ignore-scripts flag makes that install fail closed without changing the non-privileged test workflow.

Tracks PLA-315.

Validation

• yarn install --frozen-lockfile --prefer-offline --ignore-scripts
• yarn build
• npm publish --dry-run for all four workspaces
• git diff --check

The full local test suite was also attempted from the scripts-disabled install. SQLite-backed tests cannot load sqlite3 because its native binding is installed by a lifecycle script; this is expected for the hardened publish environment, which only builds releasable packages. The ordinary test workflow remains unchanged and continues to install the binding.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 84.18%. Comparing base (30c9986) to head (96a23ee).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #200   +/-   ##
=======================================
  Coverage   84.18%   84.18%           
=======================================
  Files           9        9           
  Lines        2074     2074           
  Branches      428      428           
=======================================
  Hits         1746     1746           
  Misses        322      322           
  Partials        6        6           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 7a45c6b4-3bfc-4833-89cb-c41bb5f1c9ed

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}