Configure npm to ignore-scripts

[westonruter]

This is a security hardening improvement.

See Core-64543.

[github-actions]

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

If you're merging code through a pull request on GitHub, copy and paste the following into the bottom of the merge commit message.

Co-authored-by: westonruter <westonruter@git.wordpress.org>
Co-authored-by: thelovekesh <thelovekesh@git.wordpress.org>

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.

[westonruter]

I realize this will probably break Husky from automatically getting set up.

[thelovekesh]

This would be a somewhat restrictive change, since we do occasionally need postinstall scripts, especially when a dependency needs to compile native C or C++ modules.

If we go down this path, it would make more sense to switch to a better package manager that supports whitelisting packages allowed to run postinstall scripts, such as Bun.

These modern package managers also come with several additional benefits, like cooldown periods when installing new dependencies, and they are also insanely fast.

[westonruter]

This would be a somewhat restrictive change, since we do occasionally need postinstall scripts, especially when a dependency needs to compile native C or C++ modules.

Is this needed for this repo, however?

If we go down this path, it would make more sense to switch to a better package manager that supports whitelisting packages allowed to run postinstall scripts, such as Bun.

I hesitate to diverge from using a package manager different from what is being used in core or Gutenberg.

[thelovekesh]

Is this needed for this repo, however?

Not sure, but it's just a possibility in addition to what you noted for husky.

[westonruter]

In the meantime, I've added a ~/.npmrc with ignore-scripts = true.

[thelovekesh]

Also, it would be better if we can add a command like setup to run any required lifecycle scripts and document it to run it manually while setting up the project for the first time.