You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
NPM packages can run arbitrary scripts when installed. To improve security in CI pass in --ignore-scripts flags.
Developers locally can also choose to use npm install:ci if they want the same assurances locally too.
Nx requires a post install script to run so we explicitly run it via running pnpm rebuild nx. If any other packages require a postinstall scripts we should do the same. This makes it so we never are accidentally introducing a new script we didn't realize is running.
The overall change involves standardizing the dependency installation process across various configurations and Dockerfiles to a specific pnpm install:ci command. This shift is likely aimed at optimizing the installation for continuous integration (CI) environments, ensuring consistency and potentially leveraging caching or other CI-specific optimizations. Additionally, for the metamask service, a security-focused change was made to ignore scripts during installation.
Replaced pnpm install with pnpm install:ci to standardize the CI dependency installation process.
ufm-test-services/metamask/Dockerfile
Modified pnpm install to include --ignore-scripts flag for security reasons.
Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on X ?
Tips
Chat with CodeRabbit Bot (@coderabbitai)
You can reply to a review comment made by CodeRabbit.
You can tag CodeRabbit on specific lines of code or files in the PR by tagging @coderabbitai in a comment.
You can tag @coderabbitai in a PR comment and ask one-off questions about the PR and the codebase. Use quoted replies to pass the context for follow-up questions.
CodeRabbit Commands (invoked as PR comments)
@coderabbitai pause to pause the reviews on a PR.
@coderabbitai resume to resume the paused reviews.
@coderabbitai review to trigger a review. This is useful when automatic reviews are disabled for the repository.
@coderabbitai resolve resolve all the CodeRabbit review comments.
@coderabbitai help to get help.
Additionally, you can add @coderabbitai ignore anywhere in the PR description to prevent this PR from being reviewed.
CodeRabbit Configration File (.coderabbit.yaml)
You can programmatically configure CodeRabbit by adding a .coderabbit.yaml file to the root of your repository.
The JSON schema for the configuration file is available here.
If your editor has YAML language server enabled, you can add the path at the top of this file to enable auto-completion and validation: # yaml-language-server: $schema=https://coderabbit.ai/integrations/coderabbit-overrides.v2.json
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
roninjin10
force-pushed
the
ignore-scripts
branch
from
NPM packages can run arbitrary scripts when installed. To improve security in CI pass in --ignore-scripts flags.
Developers locally can also choose to use
npm install:ciif they want the same assurances locally too.Nx requires a post install script to run so we explicitly run it via running
pnpm rebuild nx. If any other packages require a postinstall scripts we should do the same. This makes it so we never are accidentally introducing a new script we didn't realize is running.